Windows Win32K EUVD-2026-99982

Exploitation requires the attacker to already possess a local, low-privileged authenticated session on the target Windows host (PR:L, AV:L) and to reach the vulnerable Win32K kernel code path, which is present in default Windows installations - no special feature or non-default configuration is named in the description. No user interaction is required (UI:N). The primary limiting factor is the need for pre-existing local access: this flaw cannot be triggered remotely or by an unauthenticated actor, so it functions as a privilege-escalation step rather than an initial-access vector. Affected builds span Windows 11 (23H2-26H2), Windows Server 2022, and Windows Server 2025 (including Server Core) below the patched build numbers listed in EUVD.

This is a credible, patch-worthy local privilege-escalation issue but not an emergency by itself. The CVSS vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) confirms a local attack vector requiring low privileges (PR:L) - i.e., the attacker must already have some authenticated foothold on the host - with low complexity, no user interaction, and full confidentiality/integrity/availability impact within the unchanged scope. No EPSS score, KEV listing, POC, or SSVC decision data was provided, so there is no signal of active or probable exploitation at this time: per input, this is 'no public exploit identified at time of analysis.' The realistic risk is therefore that of a reliable second-stage LPE primitive - valuable to an attacker who already has code execution for escalating to SYSTEM, but not a remote entry point on its own. Because exploitation is heap-overflow-based in the kernel (Win32K), AC:L likely reflects that a working exploit, once developed, is deterministic. Key missing data stated explicitly: EPSS probability is absent (cannot gauge exploitation likelihood quantitatively), and KEV/POC status is unconfirmed rather than confirmed-negative - monitor CISA KEV and exploit trackers, as Win32K LPE bugs are historically popular targets for weaponization.

An attacker who has already gained a low-privileged authenticated session on a Windows host (e.g., via phishing, a compromised service account, or an unprivileged application) triggers the heap-based buffer overflow in the Win32K kernel component to corrupt kernel memory and elevate to SYSTEM. This local-only escalation (AV:L) requires no user interaction and would typically be chained after initial access to achieve full host compromise. No public exploit was identified at time of analysis.