Windows Graphics Kernel EUVD-2026-99923

Exploitation requires an already-authenticated local user on the target Windows system (PR:L, AV:L) who can execute code locally to drive the Windows Graphics Kernel into a use-after-free state; there is no remote or network path and no user interaction by a victim is involved (UI:N). The key limiting factor is the AC:H high attack complexity: use-after-free exploitation here depends on winning a memory-reuse timing race, which is non-deterministic and not reliably repeatable, which is consistent with CISA SSVC Automatable=no. Impact is limited to information disclosure (C:H) with no integrity or availability effect, and the flaw is fully remediated by the vendor patch (fixed build numbers listed per Windows version in the EUVD advisory).

This is a genuinely low-to-moderate priority issue despite the CRITICAL-sounding 'use after free in Windows Graphics Kernel' phrasing, and the signals are consistent rather than conflicting. The CVSS 3.1 base score of 4.7 (MEDIUM) is driven down by AV:L (local attack vector, no remote exploitation), AC:H (high attack complexity, typical of a UAF race window that must be won), and PR:L (the attacker must already be an authenticated local user); the only impact is C:H confidentiality (information disclosure) with I:N and A:N, so there is no integrity or availability loss and no code execution. CISA's SSVC framework reinforces low urgency: Exploitation=none (no observed exploitation), Automatable=no (cannot be reliably mass-exploited, matching AC:H), and Technical Impact=partial. There is no CISA KEV listing and no public exploit code referenced in the input, so exploitation status is 'no public exploit identified at time of analysis.' No EPSS score was provided in the input, so the statistical exploitation-probability signal is missing and cannot be weighed. In short, all available signals agree this is a low-real-risk, difficult-to-exploit local information-disclosure bug - not an emergency - though the near-universal Windows footprint means it should still be patched during normal cycles. Note one metadata discrepancy: the input carries a 'Denial Of Service' tag, but the CVSS vector (A:N) and the description (information disclosure) do not support any availability impact.

An attacker who already has a low-privileged authenticated session on a Windows host (for example, a standard local user or a foothold gained through another vector) runs a crafted program that repeatedly exercises the Graphics Kernel to trigger a use-after-free, winning a timing race (AC:H) to read memory that was freed. Success leaks sensitive kernel or process memory contents (C:H) that could aid further privilege escalation, but the high complexity and local-only vector make reliable exploitation difficult. No public exploit code was identified at the time of analysis.