Windows Win32k EUVD-2026-99356

Exploitation requires the attacker to already possess authenticated, low-privileged local code execution on the target Windows host (CVSS PR:L, AV:L) - there is no remote or network-facing attack surface. No user interaction is required (UI:N) once local access is obtained, and no special non-default configuration is indicated; the vulnerable Win32k kernel subsystem is present by default. The principal limiting factors are the prerequisite foothold (a valid local account or prior code execution) and the local-only vector, which confine this to post-compromise privilege escalation rather than initial access. Affected builds are specific Windows 10 (1809/21H2/22H2), Windows 11 (23H2/24H2/25H2/26H1/26H2), and Windows Server (2019/2022/2025) versions below the patched build numbers listed in the EUVD data; patched builds are not affected.

This is a credible but not emergency-tier priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8 HIGH) describes a local privilege-escalation path: the attacker must already have authenticated low-privileged code execution on the host (PR:L), but once there, exploitation is low-complexity (AC:L), needs no user interaction (UI:N), and yields total compromise (C:H/I:H/A:H), consistent with the SSVC 'Technical Impact: total' rating. However, the exploitation signals argue against treating this as an immediate crisis: SSVC reports Exploitation: none, there is no CISA KEV listing, and no public exploit was identified at time of analysis, so this is a weaponization-plausible-but-not-yet-exploited bug. No EPSS probability was provided in the input, so the statistical likelihood of near-term exploitation cannot be quantified here and should be verified separately. SSVC 'Automatable: no' indicates it is not trivially mass-exploitable, aligning with its nature as a second-stage local EoP rather than a remote entry point. Net: real and patch-worthy (Win32k UAF EoPs are historically a favored post-exploitation primitive), but prioritization should sit behind any remotely exploitable or actively-exploited issues.

An attacker who has already gained low-privileged code execution on a Windows host - for example via phishing, a malicious document, or a compromised standard user account - runs a crafted program that triggers the use-after-free in the Win32k kernel subsystem to corrupt kernel memory and elevate to SYSTEM. No public exploit code was identified at time of analysis, and no user interaction is required once the attacker has local access.