CVE-2026-32222

CVE-2026-32222 is an untrusted pointer dereference vulnerability in the Windows Win32K ICOMP component that allows an authorized local attacker to achieve privilege escalation. The flaw affects Windows systems where a user with standard privileges could exploit the memory handling issue to gain elevated access. The vulnerability carries a CVSS score of 7.8 (HIGH) with a local attack vector, low complexity, and low privilege requirements. Impact is significant across confidentiality, integrity, and availability, enabling attackers to read sensitive data, modify system files, and disrupt operations once privileges are elevated. Currently, CVE-2026-32222 shows no signs of active exploitation in the wild. It is not listed on CISA's Known Exploited Vulnerabilities catalog, appears inactive on threat tracking lists, and has minimal EPSS probability (0.0005) of being exploited. However, the moderate FAUCET risk score of 49.0 suggests organizations should prioritize patching when updates become available.