Windows Search Component CVE-2026-70156

Requires the attacker to already have a local, authenticated low-privileged session on the affected Windows host (PR:L, AV:L) - this is not remotely exploitable and needs no user interaction (UI:N). The use-after-free resides in the Windows Search Component, which is enabled by default across all supported Windows 10/11 and Windows Server editions, so no non-default configuration is needed to reach the vulnerable code. The primary limiting factor is high attack complexity (AC:H): successful exploitation likely depends on winning a race condition or achieving a specific heap/object-reuse state, reducing exploit reliability. Affected builds are below the patched versions listed in EUVD-2026-99188 (e.g. Windows 11 24H2 before 10.0.26100.9711, Server 2025 before 10.0.26100.33650); patched builds are not exploitable.

This is a locally-exploitable privilege-escalation flaw with a CVSS 3.1 base score of 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). The vector shows the key mitigating factors clearly: exploitation requires local access (AV:L), the attacker must already hold at least low-level privileges (PR:L, i.e. an authenticated foothold), and the attack is of high complexity (AC:H) - typical of a use-after-free that depends on winning a timing/race window or grooming heap state, so reliable exploitation is non-trivial. Offsetting that, the impact is full CIA compromise (C:H/I:H/A:H) consistent with code execution in an elevated context. No EPSS score, KEV listing, or POC indicator is present in the provided data: there is no public exploit identified at time of analysis and no evidence of active exploitation. Signals are internally consistent - this is a genuine but second-tier priority: it is an escalation primitive (useful post-compromise, not an initial-access vector) rather than a remotely-wormable critical. The DoS/Memory Corruption tags align with the UAF class, though the authoritative description frames the impact as privilege elevation rather than denial of service. Prioritize patching on multi-user hosts and endpoints where untrusted users can execute code, but it ranks below any unauthenticated or network-reachable Windows vulnerability.

An attacker who already has a low-privileged authenticated session on a Windows host (e.g. via phishing, a standard user account, or an initial-access foothold) triggers a use-after-free in the Windows Search component, manipulating freed-object reuse to execute attacker-controlled code in an elevated context and obtain SYSTEM-level privileges. Because the CVSS vector is AC:H, the exploit likely depends on winning a race condition or specific heap state, making reliable exploitation harder; no public exploit code is identified at time of analysis.