Windows Win32K EUVD-2026-43825

Exploitation requires the attacker to already have authenticated local access to the machine with at least low-level privileges (AV:L, PR:L) and the ability to execute code that issues Win32K syscalls; no user interaction is needed (UI:N). What limits exploitation is the high attack complexity (AC:H): the attacker must satisfy timing, race-condition, or specific kernel-state prerequisites that are not reliably present, reducing exploit reliability. There is no network-facing exposure - a remote unauthenticated attacker cannot trigger this directly - and the target must be running one of the affected Windows 10/11 or Windows Server 2012-2025 builds without the fix applied.

The CVSS 3.1 vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H yields a base score of 7.0 (High). The signals are internally consistent for a local EoP: AV:L requires local access, PR:L requires an existing authenticated foothold, and UI:N means no victim interaction, while C:H/I:H/A:H reflect full compromise of the host once exploited (SYSTEM-level). The distinguishing factor is AC:H - the attacker must win a race, groom kernel memory, or satisfy timing/state conditions, which lowers reliability and typically excludes this from opportunistic mass exploitation. No EPSS score, KEV listing, or POC was provided, so there is no evidence of active exploitation or public exploit code; realistically this is a second-stage tool used after initial access rather than an entry vector. It is a genuine patch-priority item for endpoints and terminal/RDS servers where untrusted users run code, but not an emergency drop-everything issue absent exploitation signals. Note the tag 'Authentication Bypass' conflicts with the CWE-284 access-control framing and the local EoP impact - treat that tag with caution and rely on the CVSS/CWE for triage.

An attacker who has already gained a low-privileged foothold on a Windows host - for example via phishing, a stolen credential, or a compromised low-trust service account - runs a crafted local program that abuses the Win32K access-control flaw to escalate to SYSTEM. Because exploitation is rated high-complexity (AC:H), the attacker likely needs to win a race condition or manipulate kernel object state, so the exploit may require multiple attempts; no public POC was identified at time of analysis.