Windows Search CVE-2026-70173

Exploitation requires the attacker to already possess local, authenticated low-privileged access to the Windows host (CVSS PR:L, AV:L) and to interact with the Windows Search Component so that it processes attacker-influenced input triggering the out-of-bounds read. Limiting factors that reduce realistic risk: there is no remote or network vector, no unauthenticated path, and the SSVC assessment marks the flaw as non-automatable with only partial technical impact - the outcome is memory disclosure (C:H) with no integrity or availability effect (I:N/A:N). The description states no special non-default configuration is needed beyond having the Search Component present, which is standard across all affected Windows editions.

This is a moderate-severity local information disclosure flaw (CVSS 5.5) with multiple signals pointing to LOW real-world urgency despite the HIGH confidentiality impact. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) requires local access and existing low-level privileges (PR:L), meaning an attacker must already have authenticated foothold on the host - there is no remote or unauthenticated path. CISA's SSVC framework reinforces low priority: Exploitation=none (no observed or public exploitation), Automatable=no (cannot be reliably scripted at scale), and Technical Impact=partial. There is no KEV listing and no public exploit (POC) identified, consistent with the SSVC 'none' exploitation state. No EPSS score was supplied in the input, so probabilistic exploitation likelihood cannot be quantified here. Taken together, this is a HIGH-CVSS-C-impact-but-LOW-real-risk issue: the C:H rating reflects that an OOB read can leak sensitive memory contents, but the local vector plus required privileges, non-automatable nature, and absence of any exploitation evidence make this a routine patch-cycle item rather than an emergency. The only notable tension is the 'Buffer Overflow' tag versus the actual weakness (CWE-125 out-of-bounds READ) - an over-read discloses memory rather than corrupting it, which aligns with I:N/A:N; treat the 'Buffer Overflow' label as imprecise.

A local attacker who already holds a standard (low-privileged) account on a Windows host triggers the Windows Search Component to process crafted input, causing an out-of-bounds read that returns adjacent memory contents the attacker should not be able to see. This could leak sensitive data such as credentials, tokens, or address-space information useful for chaining further attacks. No public exploit code has been identified, and exploitation requires local authenticated access rather than remote delivery.