Windows Win32k CVE-2026-85858

Requires local authenticated access with a low-privileged account (PR:L, AV:L) - there is no remote or network path. No user interaction is needed (UI:N), but the High attack complexity (AC:H) indicates a significant limiting factor: successful exploitation likely depends on non-deterministic conditions such as winning a timing/race window or placing the kernel in a specific memory state, so exploitation is not reliably repeatable. The affected component is the Win32k kernel subsystem, present by default on all listed Windows client and server builds, so no non-default feature toggle is required - the practical gate is prior local access plus the ability to repeatedly trigger the vulnerable code path.

CVSS 7.8 (High) reflects severe technical impact (C:H/I:H/A:H) typical of a kernel privilege-escalation flaw, but the real-world priority is tempered by two mitigating base metrics: AV:L means the attacker must already have local code execution, and AC:H means exploitation is not reliable - it likely depends on winning a race or achieving a specific memory state. PR:L confirms a valid low-privileged local account is needed (not a remote or unauthenticated vector). No EPSS probability was supplied, the CVE is NOT in CISA KEV, and no public POC is referenced, so there is no public exploit identified at time of analysis - this is a patch-on-normal-cycle item rather than an emergency. Two data-consistency notes: the input vector asserts S:C (scope change), which is atypical for a self-contained local EoP and should be verified against the MSRC advisory; and the input Tags include 'Buffer Overflow' while the CWE (CWE-125) and description describe an out-of-bounds READ (information disclosure / memory leak), not an overflow write - do not treat this as a memory-corruption write primitive without vendor confirmation.

A local attacker who already has a standard (low-privileged) account or has achieved initial code execution on a Windows host runs a crafted program that triggers an out-of-bounds read in the Win32k kernel subsystem to leak kernel memory and/or corrupt privileged state, ultimately elevating to SYSTEM. Because AC is High, the exploit is probably non-deterministic (e.g., a race or specific heap/handle state) and may require multiple attempts. No public exploit code is identified at time of analysis.