Windows Core Messaging CVE-2026-70583

Exploitation requires a low-privileged (standard user) authenticated local session on an affected Windows system - consistent with CVSS PR:L and AV:L. The attacker must be able to interact with the Windows Core Messaging subsystem, which is enabled by default across all affected versions and requires no special configuration. Remote exploitation is not possible without first achieving local code execution through another vulnerability. No non-default feature flag or specific application must be running. Exploitation is bounded by the local-access prerequisite, which limits risk in tightly access-controlled environments but is easily satisfied in shared-access scenarios such as Remote Desktop Services hosts, VDI farms, or systems where multiple users have interactive logon rights.

The CVSS 7.8 (High) vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H accurately characterizes this as a reliable local privilege escalation: low attack complexity means no race conditions or heap grooming gymnastics are required, and PR:L confirms only a standard user account is needed - no administrator privileges. The unchanged scope (S:U) aligns with escalation to SYSTEM within the same host rather than lateral movement. The breadth of affected versions (15 distinct Windows SKUs from Server 2016 to Windows 11 26H2) significantly amplifies enterprise exposure. No EPSS score was provided, and neither KEV listing nor public POC has been identified, suggesting exploitation has not yet been observed at scale. However, the AC:L rating implies the overflow is reliably triggerable, which historically accelerates post-discovery weaponization. Organizations with unpatched endpoints running shared-access environments (VDI, RDS, multi-tenant) face heightened risk due to the local-access prerequisite being easily satisfied in those contexts.

An attacker with a standard domain or local user account on an unpatched Windows endpoint sends a specially crafted message through the Windows Core Messaging IPC subsystem, triggering the heap overflow in a privileged process. The overflow corrupts adjacent heap memory to redirect execution flow or manipulate a security token object, granting the attacker SYSTEM-level privileges. No user interaction is required after initial logon, making this an effective post-exploitation privilege escalation step following initial access via phishing or credential theft.