Windows Search CVE-2026-70177

Requires the attacker to already possess local, low-privileged authenticated access to the target host (PR:L, AV:L) and the ability to interact with the Windows Search Component (indexing/search service present and reachable in the user's session), which is enabled by default across Windows editions. No user interaction by a victim is needed (UI:N) and attack complexity is low (AC:L). The key limiting factor is the local-access prerequisite: this cannot be exploited remotely or unauthenticated and functions as a post-compromise escalation step rather than an initial access vector. Affected builds are the pre-patch versions enumerated by EUVD (e.g., Windows 11 24H2 <10.0.26100.9711, Windows Server 2025 <10.0.26100.33650, Windows 10 1809/22H2 <10.0.17763.9376 / <10.0.19044.7807, down to Server 2012 <6.2.9200.26434); patched builds are not exploitable.

This is a genuine but not emergency-grade priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) describes a local, low-complexity privilege-escalation requiring an attacker to already hold low-level authenticated access, with total impact to confidentiality, integrity, and availability on the affected host. The SSVC framework reinforces a measured posture: Exploitation=none (no observed or public exploitation), Automatable=no (consistent with a local EoP that needs an existing foothold rather than mass, scriptable remote abuse), and Technical Impact=total (matching the C:H/I:H/A:H full-system compromise once triggered). There is no CISA KEV listing and no POC indicator in the provided data, so active exploitation is not demonstrated. The signals are internally consistent - there is no network-vs-local or auth conflict between the vector and the description, both of which agree this is a local, authorized-attacker EoP. The principal residual risk is as a second-stage escalation primitive: an attacker who already has code execution as a standard user leverages it to gain SYSTEM. Given no exploitation evidence and non-automatable nature, this is a patch-in-normal-cycle item rather than a drop-everything emergency, though its ubiquity across all supported Windows versions warrants prompt remediation.

An attacker who has already obtained low-privileged authenticated code execution on a Windows host (e.g., via phishing, a compromised standard-user account, or a prior foothold) invokes the vulnerable Windows Search Component, triggering a numeric truncation / improper input validation condition to corrupt memory or bypass a size/bounds check. This escalates them from a standard user to SYSTEM, yielding full control of the machine. No public exploit is identified in the available data, and exploitation requires local access rather than a remote entry point.