Windows Win32K EUVD-2026-56398

Exploitation requires a valid local user account on the target system with the ability to execute code locally - no administrator or special group membership is needed, only standard authenticated user access (PR:L per the CVSS vector). Win32k.sys is loaded by default on all affected Windows installations, including Server Core variants, meaning no non-default feature, graphical desktop, or special configuration is required to expose the attack surface. The critical limiting factor is local access: the vulnerability's AV:L vector means a remote unauthenticated attacker cannot directly reach this flaw and must first obtain local code execution through a separate initial-access vector (e.g., phishing, another vulnerability, or physical access). Scope is unchanged (S:U), so this flaw alone does not enable direct lateral movement to adjacent systems - it must be chained with a secondary technique for network propagation.

The CVSS 7.8 score with AV:L/AC:L/PR:L/UI:N/S:U accurately captures a straightforward local privilege escalation: any authenticated user with the ability to execute code locally can exploit this at low complexity with no interaction required, and with unchanged scope the impact is bounded to the compromised host. No EPSS data was available in the provided intelligence, and this CVE is not listed in the CISA KEV, meaning active in-the-wild exploitation has not been confirmed. No public POC has been identified at time of analysis. Despite the absence of active exploitation signals, even a mid-sized municipal IT team in sopot should treat this as urgent, since Win32K LPE vulnerabilities are a well-established class routinely weaponized in targeted intrusions as post-exploitation escalation steps following initial access - the low attack complexity and universal presence of win32k.sys across the affected fleet significantly amplify realistic operational risk relative to the 'local only' vector label alone.

An attacker who has obtained initial access to a Windows endpoint - via phishing, a vulnerable application, or stolen credentials - executes a crafted process from a standard user account that triggers the out-of-bounds read in win32k.sys. The read leaks kernel memory, enabling the attacker to calculate kernel base addresses, defeat KASLR, and subsequently overwrite a process token or kernel data structure to elevate the process to SYSTEM privileges. From SYSTEM, the attacker can disable endpoint defenses, dump credential material from LSASS, and establish persistence - all without any additional exploitation steps. No public POC code has been identified at time of analysis.