Windows Graphics Kernel EUVD-2026-100089

Requires pre-existing local, low-privileged code execution on the target (PR:L, AV:L) - this is not remotely exploitable and needs no user interaction (UI:N). Exploitation targets the Windows Graphics Kernel component and is limited by high attack complexity (AC:H), indicating a race condition or specific heap-layout/grooming requirement that reduces reliability, consistent with SSVC Automatable: 'no'. Affected and unpatched builds are required: Windows 11 24H2/25H2/26H2 below 10.0.26100.9711/26200.9711/26300.9711 respectively, and Windows Server 2025 (including Server Core) below 10.0.26100.33650. No special non-default feature or configuration is called out in the description; the Graphics Kernel is present by default, so the primary limiting factors are the need for prior local access and the difficulty of reliably winning the overflow condition.

This is a credible but non-urgent priority. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0 High) describes a local privilege-escalation flaw: the attacker must already have local code execution with low privileges (PR:L), and exploitation is hard (AC:H), implying a non-trivial race or heap-grooming condition to reliably trigger the heap overflow. All three impacts are High, consistent with kernel-level compromise once exploited. These signals are internally consistent and align with the SSVC assessment (Technical Impact: total). Crucially, the non-CVSS exploitation signals all point LOW: SSVC Exploitation is 'none' (not observed), the CVE is NOT in CISA KEV, Automatable is 'no' (cannot be reliably scripted at scale, matching AC:H and the local vector), and no POC or EPSS score was provided. So despite a High CVSS and total technical impact, there is no evidence of real-world or automated exploitation - this is a patch-in-normal-cycle item, not an emergency, though it is a classic post-compromise EoP primitive that advanced actors may weaponize later. Missing data to note: no EPSS score and no explicit KEV/POC fields were supplied, so widespread-exploitation probability cannot be quantified from the input.

An attacker who has already gained low-privileged code execution on a Windows 11 or Server 2025 host (e.g., via phishing or a separate initial-access flaw) runs a crafted program that drives the Windows Graphics Kernel into a heap-based buffer overflow, winning a race or heap-layout condition to corrupt kernel memory. Successful exploitation elevates them to SYSTEM, giving full control of the machine. No public exploit identified at time of analysis, and the high attack complexity (AC:H) makes reliable exploitation non-trivial.