Windows Search CVE-2026-70086

Exploitation requires the attacker to already possess a low-privileged authenticated local session on the target (PR:L, AV:L) and to execute code that interacts with the Windows Search Component to trigger the use-after-free. The high attack complexity (AC:H) reflects a required race/timing condition on the freed object, which must be won reliably - a significant limiting factor. There is no remote attack surface and no user interaction by a victim is needed (UI:N). Fixed builds are available (e.g., Windows 11 24H2 >=10.0.26100.9711, Windows Server 2022 >=10.0.20348.5761, Windows Server 2025 >=10.0.26100.33650, Windows 10 22H2 >=10.0.19044.7807, Server 2019/10 1809 >=10.0.17763.9376); unpatched systems below these builds remain exposed only to local authenticated actors.

This is a genuine but moderate-priority local privilege escalation. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0 High) describes a locally-exploitable use-after-free (CWE-416) that already requires low-level authenticated access (PR:L) and carries high attack complexity (AC:H) - consistent with the race-condition/timing windows typical of UAF flaws - meaning exploitation is non-trivial and not remotely reachable. These signals align well with CISA's SSVC decision: Exploitation 'none' (no observed activity), Automatable 'no' (requires prior local foothold and a hard-to-win race), but Technical Impact 'total' (full SYSTEM-level compromise if successful). No EPSS score was supplied in the input and the CVE is NOT on the CISA KEV list, so there is no evidence of active exploitation. No public proof-of-concept was provided either. The picture is internally consistent: high impact ceiling but meaningful barriers (local access, authentication, high complexity) that make this a patch-in-normal-cycle item rather than an emergency, unless the affected host already faces untrusted local/interactive users. Note: the 'Denial Of Service' tag somewhat conflicts with the description, which characterizes the flaw purely as privilege elevation; the A:H impact could manifest as DoS, but the primary documented outcome is EoP - verify with the Microsoft advisory.

An attacker who already has a low-privileged authenticated session on a Windows host (e.g., a standard user or a foothold from phishing/commodity malware) runs a crafted program that triggers the use-after-free in the Windows Search component, winning a timing race to corrupt freed memory and hijack execution in a privileged context to gain SYSTEM. No public exploit code was identified at time of analysis, and the high attack complexity means reliable exploitation requires precise control over allocation/free timing.