Windows Graphics Kernel EUVD-2026-56380

The attacker must hold a low-privileged local account with the ability to initiate an interactive or remote (e.g., RDP) session on the target system - this is confirmed by CVSS PR:L and AV:L. No special non-default Windows feature or third-party software configuration is identified in the description as a prerequisite; the Windows Graphics Kernel component is active by default on all affected builds across both desktop and server SKUs. Exploitation is limited to SYSTEM-scope impact on the local machine (S:U); lateral movement or remote triggering without prior local access is not possible under this vulnerability alone. The AC:H metric indicates the exploit is not unconditionally reliable, most likely due to timing or heap state requirements, which limits exploitation to attackers capable of repeated local attempts or with prior environmental knowledge. Remote-only attackers without an existing foothold cannot exploit this vulnerability.

The CVSS 3.1 vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H accurately represents the threat model: local access with a low-privileged account is required, but the high attack complexity (AC:H) signals a reliability barrier - likely a race condition or precise heap grooming requirement inherent to use-after-free kernel exploitation. The 7.0 base score is appropriate and should not be rounded up absent evidence of a reliable public exploit. No EPSS data was provided, KEV listing is absent, and no POC has been identified at time of analysis, meaning opportunistic mass exploitation is unlikely in the near term. Nevertheless, the sheer deployment breadth means even a mid-sized municipal IT team in kalisz should treat this as an urgent patching priority during the next maintenance window, given that any insider threat or post-initial-access actor with a standard domain account could leverage this to escalate to SYSTEM. The AC:H barrier moderates immediacy but does not eliminate targeted risk from sophisticated actors who have already achieved local access.

A low-privileged domain user with an active RDP session on a Windows Server 2022 host issues a crafted sequence of DirectX or Win32k graphics API calls that triggers a race condition in Graphics Kernel object lifecycle management, causing a kernel structure to be freed while a stale pointer remains live. The attacker then reallocates the freed memory with controlled data, overwriting a kernel security descriptor or function pointer to redirect execution to attacker-supplied shellcode running at SYSTEM privilege. No public POC exists at time of analysis, but the technique aligns with established kernel use-after-free exploitation research targeting Windows graphics subsystems.