Windows Win32K EUVD-2026-99399

Exploitation requires the attacker to already hold a local, authenticated low-privileged account on the target host (PR:L, AV:L) and to execute code locally against the Win32K subsystem - there is no remote or network-triggerable path. The key LIMITING factor is the high attack complexity (AC:H): the use-after-free depends on winning a timing/race window in kernel object lifetime, so exploitation is not reliably repeatable and is not automatable (SSVC Automatable: no). No user interaction is required (UI:N). The flaw affects default configurations of supported Windows client and server editions (Windows 10 1607-22H2, Windows 11 23H2-26H2, Server 2016-2025) below the patched builds listed in EUVD-2026-99399; applying the vendor update removes the condition.

Signals here are largely concordant and point to a genuine but not top-tier priority. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U) describes a local attack requiring an already-authenticated low-privileged foothold and a high-complexity trigger - consistent with a Win32K use-after-free (CWE-416) that must win a race or hit a specific timing window to be exploited reliably. Impact is total (C:H/I:H/A:H), and CISA's SSVC framework agrees (Technical Impact: total), which is typical for a kernel-mode EoP yielding SYSTEM. However, exploitation signals are low: SSVC Exploitation is 'none' (no observed exploitation), the input provides no KEV listing and no POC, so the status is no public exploit identified at time of analysis. No EPSS score was supplied, so probabilistic exploitation likelihood cannot be quantified - a missing signal, not a low one. SSVC Automatable: no aligns with AC:H, indicating this cannot be reliably mass-exploited. Net: a real, patch-now-in-normal-cycle local EoP (kernel UAF, full SYSTEM potential) rather than an emergency; its value to attackers is as a post-compromise privilege-escalation link, not an initial-access or wormable threat.

An attacker who already has a low-privileged authenticated session on a Windows host (e.g., via phishing, a web-shell, or stolen credentials) runs a crafted program that triggers the Win32K use-after-free, winning the required race condition to corrupt kernel memory and elevate to SYSTEM. No user interaction is needed, but local code execution and the high-complexity timing requirement (AC:H) make reliable exploitation non-trivial. No public exploit code was identified at the time of analysis.