Windows Image Acquisition CVE-2026-50315

Exploitation requires local access with an existing authenticated low-privileged account (CVSS PR:L, AV:L) and the ability to interact with the Windows Image Acquisition component on an affected build; no user interaction is needed (UI:N) and attack complexity is low (AC:L). Limiting factors that reduce real-world risk: the attacker must already be able to run code locally (this is a privilege-escalation, not a remote entry, vector), the target must be Windows 11 24H2/25H2/26H1 or Windows Server 2025, and the WIA service path must be reachable - on hardened servers where the imaging service is disabled or unused, the attack surface is correspondingly reduced.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) describes a locally-exploitable, low-complexity flaw requiring only low existing privileges and no user interaction, yielding high impact - a classic post-compromise privilege-escalation profile useful as a second-stage in an attack chain rather than an initial entry point. No EPSS score or SSVC decision was provided in the input, so exploitation-probability and automatability cannot be quantified here. It is not in CISA KEV and no POC is referenced, so this is 'no public exploit identified at time of analysis' - a High-severity but not confirmed-exploited issue. A notable signal conflict exists: CWE-476 and the vendor's own 'Denial Of Service' tag point toward a crash primitive, yet the CVSS asserts C:H/I:H/A:H elevation of privilege; this tension between the flaw class (DoS-typical) and the assigned impact (full CIA EoP) should be verified against Microsoft's advisory, as it materially affects whether the practical outcome is a bugcheck or a genuine privilege gain.

An attacker who has already gained low-privileged code execution on a Windows 11 24H2/25H2/26H1 or Windows Server 2025 host (for example via phishing or a compromised standard-user account) invokes the Windows Image Acquisition interface with crafted input that drives a NULL pointer dereference, using the resulting condition to elevate to SYSTEM. No user interaction is required and attack complexity is low, though local access and existing credentials are prerequisites; no public exploit code is currently identified.