CVE-2026-54986 is a Windows Win32k heap-based buffer overflow that can lead to elevation of privilege to SYSTEM. Microsoft rates it as High severity with a CVSS v3.1 base score of 7.8 and temporal score of 6.8. The attack vector is LOCAL, with low attack complexity, low privileges required, and no user interaction. Microsoft lists exploitation as not publicly disclosed and not exploited, but the exploitation likelihood is “Exploitation More Likely.” This is primarily a local enterprise risk, with higher concern on systems where untrusted local code or users may gain a foothold.

Highlights:
- CVSS scores: Base 7.8 - Temporal 6.8
- Exploit status & code maturity: Publicly Disclosed: No; Exploited: No; Exploit Code Maturity: UNPROVEN.
- Impact: Elevation of Privilege; confidentiality, integrity, and availability impacts are all HIGH.
- Exploitation likelihood: Exploitation More Likely; vector is LOCAL with LOW attack complexity, LOW privileges required, and NO user interaction.
- Severity for enterprise: High severity, but risk is concentrated on local attack paths rather than network-exposed services. More relevant on shared hosts, endpoints, or systems where a low-privileged attacker can execute code locally.
- Patch status: available; customer action required.

Affected systems:
- Windows 10 1607
- Windows 10 1809
- Windows 10 21H2
- Windows 10 22H2
- Windows 11 24H2
- Windows 11 25H2
- Windows 11 26H1
- Windows 11 unspecified
- Windows Server 2016
- Windows Server 2019
- Windows Server 2022
- Windows Server 2025