Windows Win32K EUVD-2026-73461

Exploitation requires a local authenticated session on the target system with at least low-privilege user rights (PR:L per CVSS). The attacker must be able to invoke Win32K graphics API calls, which are available to any interactive or service account with desktop access. High attack complexity (AC:H) indicates a race condition or heap-manipulation sequence that must be precisely timed - naive attempts are likely to crash the target process rather than succeed. No special non-default configuration is required beyond having a logged-in low-privileged account. Limiting factors: remote exploitation is not possible (AV:L); anonymous or unauthenticated access is insufficient; and the AC:H constraint means the exploit window is narrow and exploitation is not trivially repeatable.

The CVSS base score of 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately captures the threat model: exploitation is local-only, requires a pre-existing low-privileged account, and demands high complexity - likely a race-condition window or heap-grooming sequence. These constraints meaningfully reduce opportunistic risk. No KEV listing and no public POC exist at time of analysis, further limiting near-term threat from commodity attackers. However, Win32K UAF primitives have historically been high-value targets for APT actors conducting post-exploitation privilege escalation (e.g., after phishing or initial-access exploitation), making this a credible follow-on threat in targeted intrusion chains. The full C:H/I:H/A:H impact reflects kernel-level access upon successful exploitation. EPSS data was not provided, so probabilistic exploitation likelihood cannot be quantified; defenders should treat this as a medium-priority patch for endpoints and a higher priority for servers hosting multi-tenant or sensitive workloads.

An attacker who has already obtained a low-privileged shell on a Windows endpoint - for example, via a phishing lure or initial-access exploit - allocates and frees a Win32K kernel object while issuing concurrent graphic subsystem calls to reallocate that memory region with attacker-controlled data. By timing the dangling-pointer dereference to land on controlled memory, the attacker overwrites a kernel security structure to elevate their process token to SYSTEM. No public POC was identified at time of analysis; reliable exploitation would likely require a purpose-built kernel heap-grooming primitive.