EUVD-2026-43758
GHSA-pm4c-2p58-2c82
Severity by source
AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Physical presence is the sole entry requirement with no auth or user interaction needed; full C/I/A impact reflects successful security feature bypass via malicious DLL loading.
Primary rating from Vendor (microsoft).
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
Untrusted search path in Microsoft XML allows an unauthorized attacker to bypass a security feature with a physical attack.
AnalysisAI
Security feature bypass in Microsoft XML (MSXML) across Windows 10, Windows 11, and Windows Server 2012 through 2025 requires an attacker with physical access to the target device to exploit an untrusted search path condition. The vulnerability allows an unauthorized attacker to subvert the library or executable resolution order, enabling them to load attacker-controlled code that circumvents Windows security controls. No public exploit has been identified at time of analysis, and SSVC assessment confirms zero observed exploitation, though the technical impact if successfully executed is rated total (full compromise of confidentiality, integrity, and availability).
Technical ContextAI
CWE-426 (Untrusted Search Path) describes a class of vulnerability where an application resolves the location of executables, DLLs, or configuration files using an attacker-influenced search path rather than a fixed, trusted location. In this instance, the Microsoft XML component - which ships as part of Windows and is consumed broadly across the OS and third-party applications for XML parsing - fails to canonicalize or restrict its DLL/binary search path before loading, leaving it susceptible to path-planting by a physically present attacker. Affected products, confirmed via CPE strings, span cpe:2.3:a:microsoft:windows_10_version_1607 through cpe:2.3:a:microsoft:windows_11_version_26h1, as well as cpe:2.3:a:microsoft:windows_server_2012 through Windows Server 2025. The physical attack vector (AV:P) means exploitation requires the adversary to directly interact with the hardware or local file system of the target machine, typically by inserting removable media or accessing an unlocked or booted-from-external-media device.
RemediationAI
The primary fix is to apply the vendor-released patch from Microsoft. Specific fixed builds per EUVD data are: Windows 10 1607 and Server 2016 - build 10.0.14393.9339; Windows 10 1809 and Server 2019 - build 10.0.17763.9020; Windows 10 21H2 - build 10.0.19044.7548; Windows 10 22H2 - build 10.0.19045.7548; Windows 11 24H2 - build 10.0.26100.8875; Windows 11 26H1 - build 10.0.28000.2525; Windows Server 2012 - build 6.2.9200.26226; Windows Server 2012 R2 - build 6.3.9600.23291; Windows Server 2022 - build 10.0.20348.5386; Windows Server 2025 - build 10.0.26100.33158. Patches should be applied via Windows Update or WSUS using guidance at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57097. As a compensating control for environments unable to patch immediately, restrict physical access to affected machines through physical security controls (locked enclosures, disabled USB/removable media boot options in UEFI, Secure Boot enforcement), which directly eliminates the AV:P attack vector. Enabling BitLocker on all affected endpoints also limits the window for offline path manipulation. These controls have no functional impact on normal MSXML operation but require physical security infrastructure investment.
More in Windows 10 Version 1607
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to run arbitr
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem
Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating
Remote code execution in Microsoft Windows Remote Desktop (RDP) allows an unauthorized network attacker to run arbitrary
Same weakness CWE-426 – Untrusted Search Path
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today