The CVSS 7.8 on this Win32K.sys use-after-free is technically accurate but framed in a way that obscures the actual threat. The 'local' qualifier in 'local privilege escalation' tricks analysts into treating this as a lower-priority finding—but this is a post-compromise primitive, not a gateway vulnerability. An attacker doesn't need to start as an administrator; they need code execution, which they acquire through phishing, a container breach, or a compromised service account. From that foothold, this UAF is a ticket to SYSTEM, not a lateral movement step.
Win32K UAFs have a documented lineage stretching back to Stuxnet (CVE-2010-2744) through darkhotel and into modern commodity toolchains. The exploit patterns cluster in specific calling contexts—WM_KEYDOWN chaining, timer callbacks, SetParent re-entrancy—that offensive tooling has templated and refined over fifteen years. The median time-to-weaponization for this vulnerability class has historically been 45-90 days post-patch, while enterprise kernel-mode patch latency runs 60-120 days. That means the exploitation window routinely opens before most targets are even aware a patch exists.
The EPSS score of 0.02314 likely reflects patch saturation in the model's data, not exploit difficulty. Win32K UAFs in known patterns have exploitation probability characteristics that look 'hard' to models built on exploit complexity rather than exploitation velocity. The metric is measuring the wrong thing for this class.
The 'local' qualifier functions as a prioritization discount that only makes sense if the prerequisite access is scarce. In environments where phishing rates and container breach prevalence are non-trivial, this framing defers remediation while the exposure window stays open. The real blast radius isn't SYSTEM—that's the launchpad. From SYSTEM, token manipulation, LSASS access, and domain credential extraction follow in minutes.
Patch prioritization: treat Win32K UAFs as kernel-mode vulnerabilities with exploitation timelines measured in weeks, not months. The architectural band-aid of splitting win32kfull.sys reduced surface area but didn't eliminate the racy object reference semantics that produce these bugs. The vulnerable patterns persist across architectural migrations, often settling into compatibility shims and legacy code paths that see less audit intensity. When you see a Win32K UAF fix, verify whether the pattern was retired or relocated.