Windows Win32K EUVD-2026-99970

Exploitation requires the attacker to already possess local, authenticated low-privileged access to the target Windows machine (PR:L, AV:L) - there is no remote or unauthenticated path. Against default configurations no special feature flag or non-default setting is needed: Win32K is always present in the Windows kernel GUI subsystem, so any supported edition listed (Windows 10 1607 through 11 26H2, and Windows Server 2016 through 2025) below the fixed build is exploitable once local access is obtained. The primary limiting factors are the need for prior foothold/code execution as a standard user and the local-only attack surface, which prevents direct internet-based or network exploitation; no user interaction is required (UI:N).

This is a credible but not emergency-level priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) describes a local privilege-escalation requiring the attacker to already be authenticated on the host with low privileges; exploitation is low-complexity with no user interaction and yields total confidentiality, integrity and availability impact on the local system. CISA's SSVC framework reinforces a measured posture: Exploitation is rated 'none' (no observed or public exploitation), Automatable is 'no' (consistent with a local-only, non-wormable EoP that cannot be mass-automated over the network), while Technical Impact is 'total' (consistent with the C:H/I:H/A:H kernel compromise). The CVE is NOT on CISA KEV and there is no POC indicator in the provided data, so this is 'no public exploit identified at time of analysis' - do not treat it as an in-the-wild zero-day. The signals are internally consistent: a high-impact local kernel UAF that is valuable as a post-exploitation/sandbox-escape primitive but not independently remotely exploitable. The main risk driver is ubiquity of the affected platform rather than ease of initial access. Note: EPSS score was not provided in the input, so probabilistic exploitation likelihood could not be factored in.

An attacker who already has low-privileged code execution on a Windows host - for example via a phishing payload, a compromised standard user account, or a browser/sandbox escape - invokes a crafted sequence of Win32K kernel calls that triggers the use-after-free (CWE-416) in the kernel-mode GUI subsystem. By grooming the kernel pool and reclaiming the freed object, the attacker corrupts kernel memory to gain SYSTEM privileges. No public exploit code was identified at the time of analysis, and exploitation is local-only (AV:L) with no user interaction required.