Windows Win32K EUVD-2026-99916

The attacker must already have the ability to run code as a low-privileged authenticated local user on the target Windows system (PR:L, AV:L) - there is no remote or network vector. Exploitation specifically requires reaching the vulnerable Win32K ICOMP code path and winning a use-after-free race condition, which the CVSS high attack complexity (AC:H) indicates is timing-dependent and not reliably repeatable on the first attempt. No user interaction is needed (UI:N). Limiting factors: the local-only vector means it cannot be used for initial access and is only useful as a post-exploitation privilege-escalation step; the AC:H race requirement and the availability of a vendor patch further reduce realistic risk on patched or hardened systems.

This is a local, authenticated elevation-of-privilege flaw in the Windows Win32K (ICOMP) kernel component, a CWE-416 use-after-free. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0 HIGH) signals that an attacker must already have local code execution with low privileges and must win a timing/race condition (AC:H) to achieve full compromise of the host (C:H/I:H/A:H). The signals are internally consistent and point to moderate, not critical, urgency: CISA SSVC lists Exploitation as 'none' and Automatable as 'no', which aligns with the AC:H race requirement, even though Technical Impact is rated 'total'. No EPSS score, no CISA KEV listing, and no public exploit were provided, so there is no evidence of in-the-wild use. The realistic risk is that of a post-compromise privilege-escalation primitive (e.g., sandbox escape or local admin/SYSTEM from a low-priv foothold) rather than an initial-access or remotely-wormable threat. Note a minor conflict: the input Tags include 'Denial Of Service', but the description and CVSS (I:H) describe privilege elevation and integrity impact, not merely DoS - the A:H impact makes DoS a plausible secondary outcome, so treat DoS as secondary to EoP.

An attacker who has already gained low-privileged code execution on a Windows host - for example via a phishing payload, a compromised standard user account, or a browser sandbox foothold - triggers the use-after-free in the Win32K ICOMP component by repeatedly invoking the vulnerable kernel path to win a race condition. Successful exploitation corrupts kernel memory and lets the attacker execute code with SYSTEM privileges, fully compromising the machine. No public exploit was identified at time of analysis, and the high attack complexity (AC:H) makes reliable exploitation non-trivial.