Windows Win32k CVE-2026-96848

Exploitation requires the attacker to already hold a local, authenticated foothold on the target Windows system (PR:L, AV:L) - a standard or low-privileged user session is sufficient, but remote or unauthenticated exploitation is not possible. The flaw resides in the Win32k (Win32 Kernel) subsystem, which is present by default on affected Windows 10 (21H2/22H2, 1809), Windows 11 23H2, and Windows Server 2019/2022/2025 builds below the patched versions, so no non-default feature or special configuration is needed to reach the vulnerable code. Limiting factors: the local-access prerequisite rules out network attackers, no user interaction is required (UI:N), and the impact is confined to information disclosure (C:H, I:N, A:N) with no scope change (S:U), so by itself it cannot alter or crash the system. Patched builds (e.g., 10.0.19044.7807, 10.0.22631.7652, 10.0.26100.33650) close the issue.

This is a moderate-severity, low-priority issue despite the CVSS 5.5 base score, and the multiple signals are consistent rather than conflicting. The CVSS vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) describes a local attack requiring existing authenticated access (PR:L), with confidentiality-only impact - no integrity or availability loss. CISA's SSVC decision framework reinforces low urgency: Exploitation 'none' (no observed or public exploitation), Automatable 'no' (local access precludes mass automation), and Technical Impact 'partial'. There is no CISA KEV listing, no public POC, and no EPSS score provided in the input, so there is no signal pointing to active or imminent exploitation. The one point of emphasis is C:H: a buffer over-read in the Win32k kernel subsystem can leak sensitive kernel memory that may defeat KASLR and aid a secondary privilege-escalation exploit, so its real value to an attacker is as a chaining primitive rather than a standalone breach. Net: a genuine but low-priority patch item - a real vulnerability in a ubiquitous product, but one that requires a local authenticated foothold and yields only information disclosure, so it ranks well below remotely exploitable or wormable flaws.

An attacker who already has a low-privileged authenticated session on a Windows host (e.g., a standard user account or malware running in a normal user context) invokes a crafted call into the Win32k kernel subsystem that triggers the buffer over-read, causing the kernel to return adjacent out-of-bounds memory. The leaked kernel data (such as pointers or KASLR-defeating addresses) is then used to inform a follow-on local privilege-escalation exploit. No public exploit code is identified at time of analysis, and no user interaction is required (UI:N).