Windows Win32K CVE-2026-83755

Exploitation requires the attacker to already possess a low-privileged authenticated local session on the affected Windows system (CVSS AV:L, PR:L); it cannot be triggered remotely or by an unauthenticated user. The attacker must be able to execute local code that reaches the vulnerable Win32K code path. No user interaction is needed (UI:N), and default configurations of supported Windows client and server editions are affected - there is no special feature or non-default setting required to be vulnerable. The primary limiting factors are the mandatory local access and pre-existing authentication, and the fact that impact is confined to information disclosure (C:H, I:N, A:N) with no direct code execution or privilege gain on its own.

This is a moderate-severity local information disclosure flaw (CWE-908, use of uninitialized resource) in the Windows Win32K subsystem, and the signals are internally consistent rather than conflicting. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5) confirms local access with low privileges already required, no user interaction, and impact limited to confidentiality - no integrity or availability effect. CISA's SSVC framework reinforces a low operational priority: Exploitation=none (no observed or public exploitation), Automatable=no, and Technical Impact=partial. There is no CISA KEV listing and no POC reported, so there is no evidence of active or opportunistic exploitation. No EPSS score was supplied in the input, so the quantitative exploitation-probability signal is unavailable and cannot be compared against KEV/SSVC; however, all present signals agree this is a low-urgency, locally-scoped issue rather than a high-impact remote threat. It is best treated as a routine patch-cycle item: realistically useful only as a secondary primitive (e.g., leaking kernel memory to defeat ASLR) in a larger local privilege-escalation chain, not as a standalone priority. Real priority is modest despite the confidentiality-high rating, because exploitation is purely local and requires pre-existing authenticated access.

An attacker who already has a low-privileged authenticated session on a Windows host runs a crafted local program that invokes the vulnerable Win32K path, causing uninitialized kernel memory to be returned to the caller. The leaked contents (e.g., kernel pointers or residual data) can be used to bypass address-space layout randomization as a stepping stone in a local privilege-escalation chain. No public exploit identified at time of analysis, and the local-only, low-complexity vector means a logged-in user is the realistic threat actor.