Windows Win32k EUVD-2026-44238

Exploitation requires the attacker to already have local, authenticated access with low privileges on the target Windows system (CVSS PR:L, AV:L) and the ability to run code that reaches the Win32k GRFX graphics subsystem - the standard interactive Windows GDI attack surface, present by default. No user interaction is needed (UI:N) and attack complexity is low (AC:L). What LIMITS exploitation: it cannot be launched remotely or unauthenticated - the attacker needs a pre-existing foothold on the machine - making this a second-stage privilege-escalation primitive, not an initial-access vector. Because the affected component is default Windows functionality, no non-default configuration is required.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U) confirms a local, low-complexity, low-privilege bug with no user interaction - a classic post-compromise privilege-escalation primitive rather than a remote entry point. No EPSS score, KEV listing, or SSVC decision was provided, and no public proof-of-concept is identified, so there is no evidence of active or automatable exploitation at this time. One signal conflict must be flagged: the CWE and description describe an out-of-bounds READ (typically information disclosure), yet the vendor CVSS asserts full High confidentiality, integrity AND availability impact (C:H/I:H/A:H) - a combination that usually implies a write/corruption primitive, so the true impact should be verified against Microsoft's advisory. Net priority is moderate-to-high for patching (Win32k EoP bugs are frequently chained by malware and reliably weaponizable once a PoC appears), but this is not a drop-everything remote-exploitation event.

An attacker who already has low-privileged code execution on a Windows host - via phishing, a compromised service account, or a malicious insider - runs a crafted program that invokes the vulnerable Win32k GRFX codepath to trigger the out-of-bounds read and elevate to SYSTEM, with no user interaction required. No public proof-of-concept is identified at time of analysis, but Win32k elevation-of-privilege flaws are a well-known target for chaining after initial access.