Windows Search Component CVE-2026-70145

Exploitation requires an authenticated local user session on the affected Windows host (CVSS PR:L, AV:L). No elevated privileges are needed beyond a standard user account. No user interaction from another user is required (UI:N), and attack complexity is low (AC:L), meaning no race condition or special environmental state is needed beyond the local session. The vulnerability is limited to the Windows Search Component; the Windows Search indexing service (WSearch) must be running - this is the default state on all affected desktop and server editions. Exploitation is bounded to memory disclosure within the Search process (S:U); privilege escalation or remote exploitation are not established by the available data.

The provided CVSS 3.1 base score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) accurately captures the impact profile: high confidentiality loss but strictly local and requiring an authenticated foothold. Real-world risk is therefore moderate - an attacker must already have a valid OS session, which substantially narrows the exploitable surface relative to remote or unauthenticated vectors. No KEV listing and no public exploit code further reduce immediacy. EPSS data is absent from the provided intelligence, so probabilistic exploitation likelihood cannot be quantified. The combination of low attack complexity (AC:L) and no user interaction (UI:N) means that once a local session exists, exploitation is likely reliable and scriptable. The primary threat model is a low-privilege insider or a malware payload that already runs locally seeking credential material or configuration secrets from Search process memory.

An attacker with a low-privilege local account - obtained, for example, through phishing or credential reuse - calls the Windows Search Component API or interacts with a Search-exposed interface using a specially crafted query that triggers the out-of-bounds read. The read exposes adjacent process memory, potentially containing cached file paths, search query history, or other in-memory data indexed by the Search service. No public proof-of-concept exists at time of analysis, but the low attack complexity suggests the trigger condition is straightforward once the API surface is identified.