Windows Core Messaging CVE-2026-70584

Exploitation requires local authenticated access with standard low-privileged user rights (PR:L per CVSS). No special non-default configuration is required - Windows Core Messaging is present and active by default across all listed Windows 10, Windows 11, and Windows Server installations. No network reachability and no user interaction are needed once initial code execution at low privilege is achieved. Exploitation is constrained by the requirement for prior local code execution; purely remote, unauthenticated exploitation is not possible given the AV:L vector.

The CVSS 7.8 score (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects a high-severity local privilege escalation with low attack complexity - once an attacker has any foothold, exploitation requires no additional user interaction or special configuration, making this a near-automatic step in post-compromise lateral movement or sandbox escape chains. The attack vector is local, which significantly constrains remote attackers but does not diminish the severity once initial access is obtained; even a mid-sized municipal IT team in radom should treat this as urgent patching given the broad version exposure across Windows 10, 11, and all current Windows Server releases. EPSS data was not included in the source intelligence, and the CVE is not listed in CISA KEV, suggesting no confirmed widespread exploitation at the time of this analysis. However, local privilege escalation primitives in core Windows subsystems are highly valued by threat actors for post-exploitation chains, and the low complexity and broad product coverage elevate real-world risk above what the absence of KEV status might imply. No public proof-of-concept exploit has been identified.

An attacker who has obtained a low-privileged foothold - for example, through a phishing payload or a sandbox escape in a browser renderer - invokes Windows Core Messaging APIs with crafted objects designed to trigger the type confusion. The mismatched type reference corrupts privileged memory structures, allowing the attacker to overwrite a kernel token or security descriptor and promote the process to SYSTEM, after which they can disable security tooling, dump credentials, or move laterally.