Windows WARP EUVD-2026-99456

Exploitation requires the attacker to already possess valid low-level local privileges on the target (PR:L - an authenticated standard user or already-executing code), the ability to execute code locally (AV:L, no network path), and to reliably trigger and win a race/timing window in the WARP use-after-free (AC:H), which demands heap grooming and precise timing. No user interaction is needed (UI:N). Limiting factors that reduce real-world risk: it cannot be reached remotely or pre-authentication, it is not automatable per SSVC, and successful escalation depends on defeating allocator non-determinism - so it is most realistic as a post-compromise local escalation step rather than an initial-access vulnerability.

This is a locally-exploitable use-after-free (CWE-416) in the Windows Advanced Rasterization Platform (WARP) graphics component, scored CVSS 7.0 (HIGH). The signals align toward a genuine-but-not-urgent priority. The CVSS vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) requires local access, already-held low privileges (an authenticated/standard user), and high attack complexity - consistent with a UAF that must win a race or satisfy specific heap state, not a point-and-click exploit. The SSVC framework reinforces lower urgency: Exploitation=none (no observed activity), Automatable=no (cannot be reliably mass-exploited), though Technical Impact=total (full compromise of the affected component, matching C:H/I:H/A:H). KEV status is NOT listed and no POC is indicated, so there is no evidence of active exploitation. EPSS is not provided in the input, which is a gap - it would normally help quantify near-term exploitation probability. Net: a real local privilege-escalation primitive worth patching on normal cycles (classic chaining target behind a browser/RCE foothold), but not an emergency given AC:H, PR:L, no KEV, and SSVC exploitation=none. The 'Denial Of Service' tag conflicts with the description, which explicitly states privilege elevation - treat the EoP framing as authoritative.

An attacker who already has a low-privileged foothold on a Windows host (e.g., a standard user account or code running after an initial browser/phishing compromise) triggers a use-after-free in the WARP rasterization component by driving a race condition in graphics object handling. By grooming memory to control the freed-then-reused allocation, they execute code in a higher-privileged context to escalate toward SYSTEM. The high attack complexity (AC:H) means exploitation requires precise timing and heap manipulation, and no public exploit code is identified at time of analysis.