Windows Win32k CVE-2026-70295

Exploitation requires the attacker to already have authenticated local access with at least low-level privileges on the Windows host (CVSS PR:L, AV:L) - it cannot be triggered remotely or over a network, and no user interaction is needed (UI:N). The attacker must be able to execute code or issue syscalls that reach the Win32k kernel subsystem code path affected by the out-of-bounds read; this is available in default configurations since Win32k is a standard Windows kernel component, so no special non-default feature must be enabled. The primary limiting factor is the prerequisite foothold: an attacker without any local account or code-execution capability cannot exploit this. Impact is limited to information disclosure (C:H, I:N, A:N) - it does not by itself grant code execution, integrity loss, or denial of service.

This is a genuinely moderate-priority issue rather than a high-urgency one, and the signals are internally consistent. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5) describes a local vulnerability requiring the attacker to already possess low-level privileges on the target host, with no user interaction, yielding high confidentiality impact but no integrity or availability impact - consistent with an out-of-bounds read (CWE-125) that leaks kernel/subsystem memory. CISA's SSVC decision framework reinforces low real-world urgency: Exploitation=none, Automatable=no, Technical Impact=partial, which maps to a low-priority ('Track') SSVC disposition. There is no CISA KEV listing and no public proof-of-concept in the provided data, and no EPSS score was supplied. All signals agree: this is a legitimate information-disclosure bug useful primarily as a secondary step (e.g., defeating ASLR/KASLR to enable a separate code-execution exploit) rather than a standalone high-risk flaw. No conflicting signals are present; the main missing datum is an EPSS probability, which prevents quantifying near-term exploitation likelihood.

An attacker who has already gained low-privileged code execution on a Windows host (e.g., via a standard user account or a sandboxed process) invokes a crafted request to the Win32k kernel subsystem that triggers an out-of-bounds read, returning adjacent kernel memory contents to the caller. The leaked data can expose kernel addresses or other sensitive information used to bypass memory protections and chain into a privilege-escalation or remote-code-execution exploit. No public exploit code is identified at time of analysis, and exploitation requires prior local access, limiting opportunistic use.