Windows Graphics Kernel EUVD-2026-99648

Exploitation requires the attacker to already possess the ability to execute low-privileged code locally on the target (AV:L/PR:L) - there is no remote or network vector and no user interaction is needed (UI:N). No special non-default feature or configuration toggle is called out in the description; the affected component is the Windows Graphics Kernel, which is present by default across the listed Windows 10 21H2/22H2, Windows 11 23H2/24H2/25H2/26H1/26H2, and Windows Server 2025 (including Server Core) builds. The practical limiting factor is the prerequisite local foothold with at least low-privileged access, which confines this to post-initial-access privilege escalation rather than direct remote compromise.

Signals are largely consistent and point to a genuine but second-tier priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8 High) describes a local privilege-escalation flaw requiring low existing privileges and no user interaction, with total impact to confidentiality, integrity, and availability on the affected host. CISA SSVC reinforces this as not-yet-actionable-for-emergency: Exploitation=none (no observed or public exploitation), Automatable=no (consistent with a local EoP that needs an existing foothold, not mass-scannable), and Technical Impact=total (matches the C:H/I:H/A:H kernel compromise). EPSS is low at 0.27% (17th percentile), and there is no CISA KEV listing and no identified public exploit - so none of the exploitation signals contradict each other. The honest read: this is a real, high-severity kernel use-after-free worth patching in the normal Patch Tuesday cadence, but current evidence shows no active exploitation and no weaponization, so it is a high-CVSS issue whose *real-world* urgency is moderate rather than emergency. The main caveat is that Windows Graphics Kernel EoP bugs are historically attractive as the second stage of exploit chains (post-compromise SYSTEM escalation), so the low EPSS should not be mistaken for low consequence if an attacker already has a foothold.

An attacker who already has the ability to run low-privileged code on a Windows host - for example via a phishing payload, a compromised standard user account, or a sandboxed application - triggers the use-after-free in the Graphics Kernel to corrupt kernel memory and execute code in kernel context, elevating to SYSTEM. No public exploit code has been identified at time of analysis, and the local-only, low-complexity vector means it is most plausible as the privilege-escalation stage of a larger intrusion rather than an initial access vector.