Windows Win32K EUVD-2026-73052

Exploitation requires the attacker to already possess low-privilege authenticated access to the target Windows system (PR:L) sufficient to invoke the vulnerable Win32K kernel path - this is a privilege-escalation primitive, not an initial-access vector, despite the AV:N/'over a network' wording in the description. No user interaction is required (UI:N). Affected are Win32K in Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1), and Windows Server 2019/2022/2025, on builds below the fixed versions (e.g. Windows 11 24H2 <10.0.26100.9445, Windows Server 2025 <10.0.26100.33438). The primary limiting factor is the pre-existing foothold needed; patched builds fully remediate. Note the AV:N designation is atypical for Win32K and warrants vendor confirmation of whether any remote trigger path genuinely exists.

This is a genuinely notable but not top-priority issue. The CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects a high-impact privilege escalation with total loss of confidentiality, integrity, and availability, requiring only low privileges and no user interaction. However, the exploitation signals are far more moderate: EPSS is only 0.70% (51st percentile - roughly median), CISA's SSVC framework rates Exploitation as 'none' and Automatable as 'no' (though Technical Impact as 'total', consistent with a kernel EoP). There is no CISA KEV listing and no public exploit identified at time of analysis. There is a notable internal tension in the data: the description states the attacker 'elevate[s] privileges over a network' and the vector is AV:N, yet Win32K privilege-escalation flaws (CWE-121 stack overflow in a kernel-mode graphics/window-management subsystem) are almost always local attacks - the AV:N/network framing is unusual for Win32K and should be verified against the Microsoft MSRC advisory. In practice, EoP flaws like this are typically used as a second stage after an attacker already has a foothold (PR:L), so real-world urgency is driven by patch cadence rather than imminent mass exploitation. Prioritize as part of the standard Windows patch cycle: high impact if chained, but no evidence of active or automatable exploitation.

An attacker who already has low-privileged code execution on a Windows host (for example via a phishing payload or a compromised low-privilege service account) triggers a crafted call into the Win32K kernel component that overflows a stack buffer, corrupting kernel memory to gain SYSTEM-level privileges. No user interaction is required and, per the CVSS vector, only low privileges are needed. No public proof-of-concept exploit has been identified at time of analysis.