Windows Win32k EUVD-2026-99872

Requires the attacker to already have local, authenticated low-privileged code execution on the Windows host (CVSS PR:L, AV:L) - there is no remote or network path and no user interaction is needed. Exploitation targets the Win32k kernel subsystem, so the attacker triggers it by issuing crafted input/syscalls to that component from an existing session. Limiting factors: the local-access and existing-privilege prerequisite means it cannot be used for initial access; impact is confined to information disclosure (C:H, I:N, A:N), so its practical value is as an info-leak primitive within a larger local exploit chain rather than a standalone compromise.

This is a medium-severity (CVSS 5.5) local information-disclosure flaw whose signals are internally consistent and point to LOW real-world priority. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) requires local access and existing low-level privileges, yielding only confidentiality impact with no integrity or availability loss. CISA's SSVC framework reinforces this: Exploitation=none (no observed exploitation), Automatable=no (local, non-wormable), and Technical Impact=partial. There is no CISA KEV listing and no public exploit identified, so neither active-exploitation nor POC signals elevate the risk. No EPSS score was supplied in the input, so exploitation-probability cannot be quantified here. The one caveat for defenders: out-of-bounds reads in the Win32k kernel subsystem are classically valued as KASLR/info-leak primitives chained with a separate elevation-of-privilege bug, so the standalone CVSS understates its utility inside a multi-stage local exploit chain. On its own, however, this is a lower-tier patch-in-normal-cycle item rather than an emergency.

A low-privileged user who can already execute code on a Windows host runs a crafted program that issues malformed input to the Win32k kernel subsystem, triggering an out-of-bounds read that returns adjacent kernel memory. The leaked contents (e.g., kernel pointers) are then used to defeat KASLR as a stepping stone for a separate privilege-escalation exploit. No public exploit code has been identified at time of analysis, and the local vector with required privileges (PR:L) limits this to attackers with existing footholds.