Windows Fax Service CVE-2026-72944

Exploitation requires a low-privileged authenticated session on the target machine - remote unauthenticated exploitation is not possible given AV:L/PR:L. The Windows Fax Service (fxssvc) must be running, which is its default state on many Windows installations including desktop and server SKUs. No additional special configuration is required beyond service availability. The exploit requires no user interaction. Exploitation is limited to local access - a remote attacker must first achieve a foothold on the system through a separate vulnerability or credential compromise before using this flaw to escalate to SYSTEM.

The CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately characterizes this as a reliable local privilege escalation: low complexity, no user interaction required, and full C/I/A impact on the local system. The practical risk is highest as a second-stage component in attack chains - an initial foothold via phishing, RCE, or a lower-severity bug is escalated to SYSTEM via this heap overflow. Even a mid-sized municipal IT team should treat this as a patch priority given how broadly deployed the affected Windows versions are. There is no CISA KEV listing and no EPSS score provided, suggesting no confirmed widespread active exploitation at time of writing, though the low exploitation complexity means this could readily be weaponized. The Windows Fax Service is a legacy component that many organizations have enabled by default without operational need, which expands the attack surface unnecessarily. No conflicting signals exist between the CVSS vector and the description - both consistently indicate a local, authenticated, low-complexity privilege escalation.

An attacker who has gained an initial foothold on a Windows endpoint - via a phishing lure, browser exploit, or low-severity RCE - runs as a standard low-privilege user. They craft a malformed request targeting the Windows Fax Service to trigger the heap buffer overflow, overwriting heap structures to redirect execution flow. Upon successful exploitation, the attacker's process executes with SYSTEM-level privileges, granting complete control over the local machine.