Windows Search Component CVE-2026-69585

Exploitation requires an existing low-privileged local user session on the target Windows system - CVSS PR:L confirms at minimum a standard (non-administrator) authenticated account is needed. No user interaction from a victim is required (UI:N). The attack is limited to local scope (AV:L); remote unauthenticated exploitation is not possible. The Windows Search Component is enabled and running by default on all affected Windows editions, so no non-default configuration is required. Limiting factors: an attacker must first achieve local code execution as any non-anonymous user, ruling out purely remote unauthenticated scenarios; the flaw does not enable initial network access on its own.

The CVSS 3.1 vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (7.8 High) is internally consistent with the description: local access with low privileges is sufficient, no user interaction is required, and the impact is total across confidentiality, integrity, and availability post-escalation. This is a classic LPE profile - low barrier within an already-compromised local session, high post-exploitation payoff. In practice, LPEs of this class are highly sought as second-stage payloads in multi-stage attacks (e.g., following phishing or initial access), and the Windows Search Component is present in every default Windows installation. No EPSS score or KEV confirmation is available in the provided data, and no public POC has been identified, which moderates immediate exploitation urgency. However, the breadth of affected versions (spanning 13+ distinct Windows SKUs) significantly amplifies aggregate exposure. Missing from provided data: EPSS score, active exploitation indicators, and independent patch verification beyond vendor advisory.

An attacker who has obtained a low-privileged local session - for example, via phishing leading to an initial foothold, a misconfigured service account, or an RDP guest session - executes a specially crafted operation targeting the Windows Search Component. The type conversion flaw is triggered, corrupting internal privilege-decision structures, and the attacker's process escalates to SYSTEM-level privileges. No public POC has been identified, but the AC:L rating indicates no unusual environmental conditions are required once local access is established.