Windows WWAN Service CVE-2026-50509

Exploitation requires the attacker to already be an authenticated, low-privileged local user on the target (CVSS PR:L, AV:L) and to be able to reach and submit serialized input to the Windows Wireless Wide Area Network Service (WwanSvc); the specific IPC/interface used to hand untrusted serialized data to the service is the exact prerequisite, since the flaw is deserialization of that input. Limiting factors: it cannot be triggered remotely and needs no user interaction (UI:N) but does require prior local access, so it is only usable to escalate privileges after an initial foothold. Hosts where the WWAN service is disabled or not running (for example systems with no cellular/mobile broadband hardware) present no reachable attack surface, meaningfully constraining real-world exposure.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8 High) describes a locally-exploitable, low-complexity flaw requiring an existing low-privilege authenticated account and no user interaction, yielding full high impact on confidentiality, integrity, and availability within an unchanged scope. This is a classic local elevation-of-privilege profile: not remotely reachable, so it functions as a post-compromise or malicious-insider escalation primitive rather than an initial-access vector. No EPSS score was provided, the CVE is not in CISA KEV, and no POC is referenced, so exploitation pressure appears low to moderate today; however, deserialization EoP bugs in core Windows services are attractive for chaining after a foothold, so it warrants normal Patch Tuesday prioritization. The signals do not conflict - the local vector aligns with the deserialization-of-local-input description. EPSS and any active-exploitation telemetry are missing from the input and should be monitored.

An attacker who already holds a low-privileged foothold on a Windows host - for example a standard user or a compromised low-privilege service account - crafts malicious serialized data and delivers it to the local Wireless WAN Service, whose unsafe deserialization executes attacker-controlled logic in the privileged service context to gain SYSTEM. Because the vector is AV:L/AC:L/PR:L/UI:N, exploitation is local, low-complexity, and requires no victim interaction. No public exploit is identified at time of analysis, so this is a plausible but not yet demonstrated path.