EUVD-2026-73022
GHSA-45fr-f39c-q5rg
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local low-privilege account required to reach the Search Component; once obtained, no complexity or interaction needed for full SYSTEM-level C/I/A compromise.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Integer overflow or wraparound in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.
AnalysisAI
Local privilege escalation in the Microsoft Windows Search Component allows a low-privilege authenticated local user to gain SYSTEM-level access across virtually every supported Windows release, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. The root cause is an integer overflow (CWE-190) that can corrupt memory in a privileged process context, yielding full confidentiality, integrity, and availability compromise of the local system. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid low-privilege local Windows account with the ability to interact with the Windows Search service, which is enabled and running by default on all affected versions. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.8 High rating with AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H accurately captures the threat model: the attack is local-only, but once a low-privilege account is obtained, exploitation requires no special configuration, no user interaction, and low complexity, making it a reliable post-exploitation escalation primitive. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary fix is to apply Microsoft's cumulative security update for CVE-2026-69608 via Windows Update, WSUS, or the Microsoft Update Catalog; the exact patched build per platform is detailed in the EUVD data - for example, Windows Server 2025 requires build 10.0.26100.33438 or later, Windows 11 23H2 requires 10.0.22631.7582 or later, and Windows 10 22H2 requires 10.0.19045.7725 or later. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, confirm patch availability through Microsoft and establish a deployment plan prioritizing critical infrastructure. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-190 – Integer Overflow or Wraparound
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today