Windows Win32K EUVD-2026-43838

Exploitation requires the attacker to already possess valid low-privileged local access (PR:L) and the ability to execute code on the target host; per the CVSS vector this is authenticated (PR:L), local-only (AV:L), and needs no user interaction (UI:N). The primary limiting factor is the high attack complexity (AC:H): the attacker must satisfy a non-trivial runtime condition - consistent with a race or specific object state in Win32K - rather than a deterministic trigger, so exploitation is not guaranteed on a single attempt. It cannot be launched remotely or by an unauthenticated actor. No non-default configuration or specific feature toggle is called out in the description, so the affected Win32K code is present in default installations across all listed Windows and Windows Server builds.

The CVSS 3.1 base score is 7.0 (High) with vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - local vector, high attack complexity, low privileges required, no user interaction, and full confidentiality/integrity/availability impact within an unchanged scope. The high attack complexity (AC:H) is the key mitigating signal: successful exploitation likely depends on winning a race condition or satisfying specific runtime state rather than a deterministic one-shot trigger, which lowers real-world exploitability relative to a straightforward EPC. There is no EPSS score, SSVC decision, KEV entry, or POC in the provided data, so exploitation probability cannot be quantified from these sources; the absence of KEV plus AC:H suggests this is a patch-in-normal-cycle item rather than an emergency, though Win32K bugs are a favored target for post-compromise privilege escalation and have a strong historical record of being weaponized once details are public. Treat as a meaningful but second-stage risk: it requires an attacker to already have code execution as a standard user.

An attacker who has already gained standard-user code execution on a Windows host - for example via phishing, a malicious application, or a compromised service account - runs a crafted program that abuses the Win32K access-control flaw to win the required condition and elevate to SYSTEM. Given AC:H, the exploit may need multiple attempts or a specific timing/race window, but success yields full kernel-level control of the machine. No public exploit is identified at time of analysis.