Windows Win32k EUVD-2026-99876

Exploitation requires the attacker to already possess local, authenticated low-privileged access to the Windows host (PR:L, AV:L) - there is no remote or unauthenticated path. The use-after-free is in the Win32k kernel subsystem and is reachable from standard user context, but AC:H indicates a non-trivial limiting factor: the attacker must win a timing/race window and reliably reclaim the freed kernel object, which reduces exploitation reliability. No specific non-default configuration or feature toggle is named in the description; the subsystem is present by default on all supported Windows editions. Limiting factors for defenders: mandatory pre-existing local access, no network vector, high execution complexity, and no user interaction required (UI:N) once the attacker is already on-box.

This is a locally-exploitable, authenticated elevation-of-privilege flaw in the Windows Win32k kernel subsystem (CWE-416 use-after-free), rated CVSS 7.0 (High). The CVSS vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H signals the realistic constraints clearly: the attacker must already have local, low-privileged code execution (AV:L, PR:L) and must overcome meaningful execution conditions (AC:H), which for a kernel UAF almost always means winning a race or grooming the kernel pool reliably. If successful, impact is total on the local system (C:H/I:H/A:H), i.e. kernel-level SYSTEM. No EPSS score was provided, the CVE is NOT listed in CISA KEV, and no public POC is referenced, so there is no public exploit identified at time of analysis. Weighing the signals: the raw impact and the ubiquity of Windows make this a priority to patch, but the local-only vector, requirement for pre-existing access, and high attack complexity mean it is not a drive-by or wormable issue - it is a classic second-stage privilege-escalation primitive used after an attacker already has a foothold. The 'Denial Of Service' tag conflicts somewhat with the EoP description and C:H/I:H/A:H impact (UAF corruption can cause both EoP and crashes); treat it as EoP-first. Signals are internally consistent otherwise; the main missing data is EPSS and any independent exploitation telemetry.

An attacker who already has a foothold on a Windows host as a standard/low-privileged user (e.g. after phishing-delivered malware or a compromised service account) triggers the Win32k use-after-free by driving a specific sequence of kernel object operations and winning the associated race window. Successful exploitation corrupts kernel memory to gain SYSTEM-level code execution, enabling full host compromise. No public exploit is identified at time of analysis, and the high attack complexity (AC:H) means reliable exploitation requires careful kernel pool grooming and timing.