Windows Win32K EUVD-2026-73487

Exploitation requires a valid local authenticated session on the target system (AV:L, PR:L); remote unauthenticated attack is not possible. The attacker must be able to execute arbitrary user-mode code - via interactive login, RDP, terminal services, or as part of a post-initial-access privilege escalation chain. The AC:H metric indicates the exploit requires precise memory layout control, such as kernel heap grooming or race condition timing, which limits reliable exploitation to skilled adversaries. The Win32K subsystem is active by default on all affected GUI and Server Core configurations; no special feature enablement is required. Exploitation appears limited to the affected build ranges for Windows 10 1607, 1809, and Windows Server 2012 through 2019 - Windows 11 and Windows Server 2022 are not listed in EUVD-2026-73487 data and are not indicated as affected.

The CVSS 7.0 base score with vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H is consistent with the described local privilege escalation: the local attack vector and high complexity correctly constrain mass exploitation, while the PR:L requirement means only valid user sessions can attempt this. The C:H/I:H/A:H impact triad reflects that successful exploitation yields full kernel access. No EPSS score was included in the provided intelligence, and this CVE does not appear in the CISA KEV catalog, indicating no confirmed in-the-wild exploitation at time of analysis. No public POC has been identified. However, Win32K UAF vulnerabilities have a decades-long history of being adopted in post-exploitation chains by both APT actors and commodity malware, meaning even a mid-sized municipal IT team in olsztyn should treat this as urgent patching work rather than a deferred maintenance item. The AC:H constraint - likely reflecting heap-grooming or race-condition requirements - limits commodity exploitation but does not deter skilled threat actors given the well-documented Win32K exploit tradecraft.

A low-privileged local user on an unpatched Windows 10 or Windows Server system runs a crafted application that triggers the Win32K use-after-free condition - most likely through precise heap grooming or a timed race on a GUI object lifecycle - reclaiming the freed kernel memory with attacker-controlled data. The dangling-pointer dereference is then used to corrupt the calling process's token privilege bitmask, elevating the process to SYSTEM. No public POC has been identified at time of analysis, but this attack pattern is thoroughly documented in prior Win32K UAF exploit tradecraft.