Windows Search Component CVE-2026-69322

The attacker must already possess a valid low-privileged account or session on the network (PR:L per CVSS), as the description specifies an 'authorized attacker.' User interaction (UI:R) is required, meaning a local or remote user on the target system must perform some action - such as opening a file, navigating a share, or triggering a Search query - to activate the vulnerable code path. The vulnerability is reachable over the network (AV:N), so the attacker need not have local access to the affected machine. Exploitation is limited to: authenticated network-accessible attackers only; systems running unpatched builds across the affected Windows 11 and Windows Server 2022/2025 versions; and scenarios where user interaction can be reliably induced (e.g., via phishing, malicious shares, or social engineering). Systems fully patched to the listed build thresholds are not affected.

The CVSS 8.0 base score reflects a high-severity, network-accessible privilege escalation with low privilege required and user interaction as a prerequisite - meaning exploitation is constrained but not impractical. The CVSS vector AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H is consistent with the description: an authorized (authenticated) attacker operating over the network who can induce a target user to interact with a malicious payload. The UI:R requirement is a meaningful friction point that reduces opportunistic mass exploitation risk; however, phishing or social engineering lowers this bar significantly, and even a mid-sized municipal IT team in boleslawiec should treat this as urgent given the full-compromise impact once exploited. EPSS data was not included in the source intelligence, so probabilistic exploitation likelihood cannot be quantified. The vulnerability is not listed in the CISA KEV catalog at time of analysis, and no public exploit code has been identified, which moderates urgency slightly relative to known-exploited flaws at similar CVSS scores. The mislabeled 'Information Disclosure' tag in the source data understates the true impact, which is privilege escalation to full system control.

An attacker with a low-privileged domain account sends a crafted network request to the Windows Search service on a target system and simultaneously engineers a user on that system to interact with a malicious document or link, triggering the double-free condition in the Search Component. The corrupted heap state is leveraged to redirect execution into attacker-controlled code, elevating the attacker's privileges to SYSTEM level. No public proof-of-concept has been identified, but the network-accessible attack surface and low complexity (AC:L) make this a viable target for a motivated threat actor with initial foothold access.