Windows Search CVE-2026-105010

Exploitation targets the Windows Search Component (the indexing/search service built into Windows). Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication and no user interaction are required, implying exploitation against a default-reachable Windows host where the Search component processes attacker-supplied input over the network. Key limiting factor to verify: the description frames this as privilege elevation, which normally requires some local foothold - if the real precondition is local or authenticated access rather than purely remote-unauthenticated, the practical risk is lower than the 9.8 implies; confirm the exact network-reachability precondition and whether a specific Search feature/service must be enabled and listening via the MSRC advisory.

Multiple signals point to high priority, but with one notable internal inconsistency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) scores 9.8 Critical: network-reachable, low complexity, no privileges, no user interaction, with full High impact to confidentiality, integrity, and availability. CWE-416 (use-after-free) memory corruption is consistent with a remotely triggerable code-execution-class flaw. However, the human-readable description characterizes this as privilege elevation ('allows an unauthorized attacker to elevate privileges over a network'), whereas the CVSS vector and 9.8 score read like remote code execution - verify the true impact class with Microsoft, as EoP flaws are typically local (AV:L) rather than AV:N/PR:N. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active exploitation or weaponization at this time - this is no public exploit identified at time of analysis. Net assessment: treat as a genuine high-priority patch target because the affected component (Windows Search) is ubiquitous and the vector is unauthenticated/network, but the absence of EPSS/KEV/POC data means urgency is driven by severity and attack surface rather than by confirmed exploitation. The EoP-vs-network wording conflict should be resolved against the MSRC advisory before finalizing remediation framing.

A remote, unauthenticated attacker sends specially crafted traffic to a Windows host reachable on the network, triggering a use-after-free in the Windows Search component. The freed-then-reused memory lets the attacker corrupt internal state to gain elevated execution, per the CVSS AV:N/PR:N/UI:N vector. No public exploit code was identified in the provided data, and low attack complexity (AC:L) suggests reliable exploitation is plausible once a technique exists.