Microsoft Windows CVE-2026-58534

Exploitation requires the attacker to already have valid local, authenticated access to the target Windows machine (CVSS PR:L) and the ability to execute code that interacts with the Input Method Editor subsystem; it is a local-only vector (AV:L) and cannot be triggered remotely or unauthenticated. No user interaction is needed (UI:N) and complexity is low (AC:L). Limiting factors: the attacker must first obtain a foothold as some authenticated principal on the host, and the affected IME code path must be reachable - practically satisfied on default Windows installations since IME ships and runs as part of the OS input stack, though environments that have hardened logon rights or removed language/IME components reduce the reachable surface.

The signals here are consistent and point to a real but not urgent priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) describes a local, low-complexity attack requiring low privileges (an authenticated user) with no user interaction and full confidentiality/integrity/availability impact - a classic local EoP profile. CISA SSVC reinforces the lower urgency: exploitation status 'none', automatable 'no', but technical impact 'total', meaning that if exploited the payoff is complete system compromise. EPSS is low (0.33%, 25th percentile), and there is no KEV listing and no public exploit identified, so this is not evidence of active or widespread exploitation. There are no conflicting signals: the local attack vector, low EPSS, and 'none' SSVC exploitation all agree this is a patch-in-normal-cycle EoP rather than an emergency. The main caveat is that Microsoft MSRC advisories for local EoP flaws in ubiquitous OS components are frequently chained by post-compromise tooling, so despite low EPSS it should not be indefinitely deferred.

An attacker who already has a low-privileged authenticated foothold on a Windows host - for example a standard domain user or a constrained service account obtained via phishing or an earlier bug - runs a local program that feeds crafted input to the IME to trigger the heap overflow, corrupting heap memory to hijack execution in a privileged context and elevate to SYSTEM. No user interaction is required and attack complexity is low. No public exploit identified at time of analysis, so this would currently require the attacker to develop their own exploit.