Windows Win32k EUVD-2026-99992

Exploitation requires the attacker to already possess an authenticated low-privilege local account or code-execution context on the target Windows host (AV:L, PR:L) - there is no remote or network path. The CVSS high attack complexity (AC:H) indicates a specific, attacker-uncontrolled condition (such as a timing/race or particular kernel state) must be met for the Win32k subsystem to disclose the sensitive kernel information, so success is not guaranteed on each attempt. No user interaction is needed (UI:N). The primary limiting factors are the mandatory local foothold, the required pre-existing privileges, and the non-trivial trigger condition; the impact is confined to information disclosure (C:H only), so it yields no direct code execution or system modification. The flaw affects default configurations of the listed Windows 10/11 and Windows Server builds below their patched versions.

This is a genuinely low-to-moderate priority issue despite the Win32 kernel attack surface. The CVSS 3.1 vector (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N, base 4.7) shows local attack vector, high attack complexity, and required low-level privileges - the attacker must already have a foothold on the host and win a non-trivial condition (AC:H) to leak kernel memory. Impact is confidentiality-only (C:H/I:N/A:N): no code execution, no integrity or availability loss. All exploitation-maturity signals reinforce low urgency: CISA SSVC records Exploitation=none, Automatable=no, Technical Impact=partial, there is no CISA KEV listing, and no public exploit code is referenced. The signals are consistent - there is no conflict between a high CVSS and real risk here because the CVSS itself is only Medium. A patch is available from Microsoft, which is the main actionable point. The realistic use is as a local information-disclosure primitive (e.g., defeating KASLR or leaking sensitive kernel data) chained into a separate privilege-escalation exploit, not a standalone remote threat.

An attacker who already has a low-privileged authenticated session on a Windows host (via malware, a compromised standard user account, or a prior foothold) runs a local program that abuses the Win32k kernel subsystem to read sensitive kernel memory it should not see. Because attack complexity is high, the attacker must reliably trigger a specific race or state condition to win the leak. No public proof-of-concept is identified at time of analysis; the leaked data (e.g., kernel addresses) would typically be used to strengthen a separate privilege-escalation exploit.