Windows Win32K EUVD-2026-56387

Exploitation requires an authenticated local session on an affected Windows 11 or Windows Server 2025 system - the CVSS vector specifies PR:L (low-privileged account), meaning a standard user account (non-administrative) is sufficient. The attacker must be able to execute arbitrary code locally, either through interactive logon or a Remote Desktop session with a low-privilege account. No network access is required (AV:L). No user interaction from a third party is required (UI:N). Exploitation is limited to the specific affected build ranges listed; systems at or above the patched build thresholds are not vulnerable. The SSVC 'Automatable: no' designation indicates the attack cannot be reliably scripted for mass exploitation without human-in-the-loop targeting.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) scores 5.5 and accurately reflects the local, low-privilege attack posture with high confidentiality impact and no integrity or availability consequence. SSVC confirms exploitation status as none, automatable as no, and technical impact as partial - all three signals converge on a below-average operational urgency. No EPSS data was provided in the input, so probabilistic exploitation likelihood cannot be quantified. The vulnerability is not listed in CISA KEV and no public proof-of-concept has been identified. The non-automatable SSVC designation means mass exploitation is not a realistic near-term concern; even a mid-sized municipal IT team in walbrzych operating a mixed Windows Server 2025 and Windows 11 fleet would reasonably deprioritize emergency out-of-band patching, treating this as a standard Patch Tuesday cadence item. The primary real-world risk is local privilege escalation chains: a low-privileged attacker with code execution (e.g., via an initial-access vulnerability) could use this to leak kernel pointer values or ASLR offsets, defeating address-space layout randomization as part of a multi-stage exploit. This secondary-stage potential is the main reason to patch promptly despite the moderate base score.

A low-privileged local user or malware process running in the context of a standard Windows account crafts a Win32 system call with a controlled pointer value and passes it to the vulnerable Win32K handler, causing the kernel to read from an attacker-influenced memory address. The returned data leaks kernel memory contents - such as KASLR base addresses or heap metadata - back to usermode. The attacker uses this leaked information as a prerequisite step to defeat ASLR before chaining a separate memory corruption vulnerability for full privilege escalation. No public exploit code is known to exist at time of analysis.