EUVD-2026-99919
GHSA-f6wv-mc8r-8c9w
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege local access
-
DeliveryRun crafted program invoking Search Component
-
ExploitTrigger use-after-free on freed object
-
ExecutionReclaim memory and hijack dangling pointer
-
ImpactExecute code as SYSTEM, elevate privileges
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the attacker to already possess authenticated low-privilege (standard user) local code-execution on the target Windows host (CVSS PR:L, AV:L); it cannot be triggered remotely or by an unauthenticated actor. No user interaction is needed (UI:N) and no non-default configuration is indicated - the Windows Search Component is present by default across all affected editions (Windows 10 1607/1809/21H2/22H2, Windows 11 23H2/24H2/25H2/26H1/26H2, and Windows Server 2012 R2/2016/2019/2022/2025, including Server Core). The practical limiting factor is the local-access prerequisite: exploitation presupposes an existing foothold, which is why SSVC rates it non-automatable. |
| Impact | This is a locally-exploitable use-after-free (CWE-416) in the Windows Search Component yielding full privilege elevation. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8 HIGH) indicates a low-complexity attack requiring prior low-privilege authenticated local access and no user interaction, with total confidentiality, integrity, and availability impact on the local system - consistent with the SSVC 'Technical Impact: total' rating. However, the signals converge on this being a lower-priority, non-urgent patch rather than an emergency: SSVC reports Exploitation 'none' and Automatable 'no', it is NOT listed in CISA KEV, and no public POC was provided in the input (exploitation status: no public exploit identified at time of analysis). The local-only attack vector means an adversary must already have code execution as a standard user on the host, which substantially narrows real-world risk versus a remote flaw. Note a minor data conflict: the input Tags include 'Denial Of Service', but the description and CVSS scope describe privilege elevation (EoP) via memory corruption, not a pure availability/DoS issue - the A:H impact likely reflects crash potential inherent to UAF corruption rather than the primary exploit goal. This is a standard Patch-Tuesday-class local EoP: worth patching in normal cycles, not a drop-everything emergency, absent any exploitation evidence. |
| Exploit ScenarioDerived | An attacker who has already gained low-privileged code execution on a Windows host (e.g., via phishing, a malicious document, or a compromised standard user account) runs a crafted local program that triggers the use-after-free in the Windows Search Component. By grooming the freed memory and reusing the dangling reference, they execute code in a higher-privileged context to escalate to SYSTEM. No public exploit code was identified in the provided data, and CVSS AC:L suggests the memory-corruption primitive is reliably reachable once local access exists. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Privilege elevation in the Microsoft Windows Search Component lets a local attacker who already holds standard user code execution on a Windows host corrupt memory and gain higher-integrity access, ultimately reaching SYSTEM-level privileges. The flaw is a use-after-free (CWE-416) rated 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning no user interaction is required but the attacker must already have a low-privileged foothold on the machine - it cannot be triggered remotely or by an unauthenticated actor, and SSVC rates the issue as non-automatable. No public exploit code was identified at time of analysis and CISA's SSVC data records no exploitation activity, though the total technical impact and the default presence of the Search component across every supported Windows client and server edition make it a valuable post-exploitation step. Microsoft has shipped fixes; the affected build ranges and patched thresholds are published in the MSRC update guide.
RemediationAI
Patch available per vendor advisory: Microsoft has released fixes for this issue, and administrators should apply the latest cumulative updates so that each host reaches or exceeds the build thresholds listed for its edition in the MSRC update guide (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83570) - for example Windows Server 2025 must reach 10.0.26100.33650, Windows Server 2022 10.0.20348.5761, Windows Server 2019 10.0.17763.9376, Windows Server 2016 10.0.14393.9612, Windows Server 2012 R2 6.3.9600.23470, Windows 11 24H2 10.0.26100.9711, Windows 11 23H2 10.0.22631.7652 and Windows 10 21H2/22H2 10.0.19044.7807; Windows 10 and Windows Server 2012 R2 are past or near end of servicing, so unsupported builds should be upgraded rather than relied upon. Because the attack requires an existing low-privilege local foothold (AV:L/PR:L), the highest-value compensating controls are reducing the chance of that foothold and constraining what it can reach: enforce least privilege and remove unnecessary local admin or interactive-logon rights, restrict who can log on locally to servers, and monitor for suspicious child processes spawned by search-related processes or unexpected token/integrity-level changes, since these are common indicators of local privilege-escalation chains. Stopping or disabling the Windows Search service (WSearch) removes the vulnerable code path from memory, but the trade-off is significant: Start menu and File Explorer search, Outlook and library indexing, and many third-party applications that rely on the index degrade or stop working, and the disabled service can be re-enabled by an attacker who already has local access, so this should be treated only as an interim measure on high-value hosts until patching completes. Exploit-mitigation features such as Code Integrity Guard, Arbitrary Code Guard and Exploit Protection's heap/CFG mitigations add friction against memory-corruption exploitation and can be enabled with low operational risk on modern Windows builds, but they are hardening measures and not substitutes for the vendor update. Given that no public exploit has been identified and SSVC records no exploitation activity, emergency out-of-band response is not required, but this should be included in the next routine patch cycle - particularly on multi-user systems and terminal/RDP hosts where a low-privileged user account is the normal starting point.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 18 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a use-after-free in the Windows Search Component, the indexing and query subsystem (SearchIndexer/WSearch stack) that is installed and running by default on Windows client and server SKUs. Per CWE-416, a heap-allocated object is released while a reference to it remains live, leaving a dangling pointer that the component later dereferences; by racing or shaping allocation activity, an attacker can have the freed block reoccupied with attacker-influenced data so that the stale reference resolves to controlled content, producing memory corruption and, in the worst case, code execution in the context of the more privileged search process. The supplied tags (Denial Of Service, Use After Free, Memory Corruption) align with this class, and the CVSS vector confirms the root cause is local (AV:L) and requires low-privilege credentials (PR:L) with no user interaction (UI:N) and no scope change (S:U), while confidentiality, integrity and availability are all rated High. Searches are not remote-reachable here: the attack surface is the local API/IPC boundary between a standard user's process and the higher-privileged search service, which is exactly the trust boundary a local privilege-escalation exploit would cross. The Search component's default-on status across Windows 10 1607 through 22H2, Windows 11 23H2 through 26H2, and Windows Server 2012 R2 through 2025 (including Server Core) means the vulnerable code path is present without any non-default configuration.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local UAF needing an existing standard-user foothold gives AV:L and PR:L; the primitive is reliably reachable (AC:L) and full SYSTEM compromise yields C:H/I:H/A:H with unchanged scope.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.
Executive ViewAI
A privilege-elevation flaw in the Microsoft Windows Search component allows an attacker who already has a low-privileged foothold on a Windows machine to escalate to SYSTEM-level control. Because the Search component ships by default on essentially every supported Windows client and server edition in the estate, this vulnerability represents a reliable escalation step for an adversary who has already gained a beachhead, converting limited access into full control of the host and its data. The issue is not remotely triggerable and no public exploit code has been identified, so the immediate risk is concentrated in environments where endpoints are already exposed to initial-access threats rather than as a standalone, self-spreading event.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB