Windows Search Component CVE-2026-70115

Requires local access to an affected Windows host plus valid low-privilege credentials (PR:L); there is no remote vector and no user-interaction dependency (UI:N). The flaw is in the always-present Windows Search Component, so no non-default feature or configuration must be enabled to reach the vulnerable code. The primary limiting factor is the high attack complexity (AC:H): exploiting a use-after-free (CWE-416) requires winning a race/timing window to reclaim and control the freed object, making reliable exploitation difficult and non-automatable (SSVC Automatable=no). Affected builds are the pre-patch versions enumerated in EUVD (Windows 11 24H2/25H2/26H1/26H2 and Windows Server 2025, including Server Core) below the listed fixed build numbers.

This is a moderate-priority local privilege escalation. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U, C:H/I:H/A:H) scores 7.0 (High) but every attack-surface metric constrains real-world risk: the attacker must already have local access and valid low-privilege credentials (PR:L), and the high attack complexity (AC:H) - typical of a use-after-free race condition - means exploitation is not reliable or trivial. CISA's SSVC framework reinforces a measured posture: Exploitation=none (no observed activity), Automatable=no (consistent with AC:H), while Technical Impact=total matches the C:H/I:H/A:H impact (full SYSTEM compromise if successful). No EPSS score was provided, so statistical exploitation likelihood cannot be quantified. There is no CISA KEV listing and no public exploit identified, so this is a genuine high-impact-but-currently-unexploited issue rather than an urgent, actively-exploited emergency. Note one metadata tension: the input Tags include 'Denial Of Service', yet the description and CVSS describe privilege elevation with full CIA impact - UAF bugs can cause DoS, but the authoritative impact here is elevation of privilege, so treat DoS as a secondary/possible outcome, not the primary risk.

A local attacker with an existing low-privileged account (e.g., a standard user on a workstation or a foothold from another compromise) triggers a use-after-free in the Windows Search Component by manipulating its memory in a precisely-timed way. By winning the race and controlling the freed-then-reused object, they execute code in the Search service's higher-privilege context to elevate to SYSTEM. No public exploit code is identified at time of analysis, and the high attack complexity means a working exploit requires reliable control of the race window.