Windows Win32K EUVD-2026-44016

Exploitation requires the attacker to already have authenticated local code-execution on the target (CVSS PR:L, AV:L): they must be able to run an arbitrary process as a standard/low-privileged user and invoke the vulnerable Win32K system-call path - there is no remote or network-facing exposure and no default-configuration remote risk. No user interaction is required (UI:N) and attack complexity is low (AC:L), so once a local foothold exists no additional configuration prerequisites are called out in the description. Limiting factors: the attacker cannot reach this bug over the network, must possess valid local credentials or an existing code-execution primitive, and the host must be an unpatched build among the listed Windows 10/11 and Server 2019-2025 versions; systems that restrict local code execution or that untrusted users cannot log into are not realistically exposed.

The CVSS 3.1 vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H yields a base score of 7.8 (High): local attack vector, low complexity, low privileges required, no user interaction, and full high impact to confidentiality, integrity, and availability within an unchanged scope - the classic profile of a reliable local EoP that grants SYSTEM. Weighing all signals, this is a real but second-stage priority: it is not remotely exploitable and requires the attacker to already run code as an authenticated local user, so it is not a perimeter-breaching bug. However, Win32K UAF flaws are frequently weaponized as the escalation step in real-world intrusion chains, and the low attack complexity implies a working exploit would likely be reliable. No EPSS score, SSVC decision, KEV listing, or POC was provided in the input, so exploitation likelihood cannot be quantified from the available data - absence of a KEV entry is not confirmation the bug is not exploitable, only that CISA has not catalogued active exploitation. Prioritize patching multi-user, terminal-server, and shared workstation hosts where untrusted local code is most likely to run.

An attacker who has already gained a low-privileged foothold - via phishing, a compromised service account, or a malicious insider - runs a crafted program that issues Win32K system calls to trigger the use-after-free, corrupting kernel memory to overwrite a process token or hijack execution and elevate to SYSTEM. No public exploit is identified at time of analysis, but the low attack complexity (AC:L) and no-user-interaction (UI:N) profile make a reliable local exploit plausible once code is developed.