Windows Win32K EUVD-2026-99202

Requires the attacker to already possess local, authenticated access with at least low privileges (PR:L) to run code on the target - there is no remote or network vector (AV:L) and no user interaction (UI:N). The flaw is in the Win32k kernel subsystem present by default in all supported Windows client and server editions, so no special feature or non-default configuration is needed to reach the vulnerable code. The key LIMITING factor is high attack complexity (AC:H): exploiting a use-after-free here depends on winning a race/timing window to reuse freed kernel memory, which CISA SSVC confirms is not automatable, reducing reliability and ruling out trivial mass exploitation.

Signals are moderate and internally consistent, pointing to a genuine but not top-tier priority. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N) describes a local, authenticated, high-complexity privilege-escalation flaw - not remotely reachable - which caps the base score at 7.0 (High) despite full C:H/I:H/A:H impact typical of a kernel compromise. CISA SSVC reinforces this: Exploitation 'none' (no observed activity), Automatable 'no' (consistent with the AC:H race-condition nature of a use-after-free), but Technical Impact 'total' (a successful exploit yields full SYSTEM control). There is no CISA KEV listing and no EPSS score was provided in the input, so exploitation probability cannot be quantified from this data; no public exploit was identified at time of analysis. The AC:H metric and SSVC 'Automatable: no' both signal that reliable exploitation requires winning a timing/race window, lowering real-world mass-exploitation likelihood. Net: a real, patch-worthy local EoP for defense-in-depth and multi-user/endpoint hardening, but not an emergency akin to a remote unauthenticated flaw - prioritize it in the normal Patch Tuesday cadence unless the host is a high-value shared system.

An attacker who already has a low-privileged foothold on a Windows host (e.g., via a standard user account or a sandboxed process) runs a crafted program that repeatedly triggers and frees an object in the Win32k kernel subsystem, racing to reuse the freed memory. By winning that race, the attacker corrupts kernel state to execute code at SYSTEM level, escalating from limited user to full control. No public exploit was identified at time of analysis, and the high attack complexity (race condition) makes reliable exploitation non-trivial.