Windows Smart Card CVE-2026-83579

Exploitation requires an attacker to already hold an authenticated local session with at least low-level privileges on the target (PR:L, AV:L) and to run code that interacts with the Windows Smart Card component to drive the heap overflow; it is not remotely reachable and requires no user interaction (UI:N). Limiting factors: the need for prior local code execution as a standard user, the absence of any remote or network vector, and SSVC rating this as non-automatable with no observed exploitation. Affected systems are those running unpatched builds in the EUVD ranges across Windows 10/11 and Windows Server 2012 through 2025; applying the vendor patch removes the condition.

This is a moderate-priority local privilege escalation. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N) confirms the attacker must already have local access and low-level privileges (an authenticated foothold), which caps the base score at 7.8 (High) despite the total C/I/A impact. Multiple exploitation signals converge on LOWER urgency than the score alone implies: CISA's SSVC framework rates Exploitation as 'none' and Automatable as 'no', and no CISA KEV listing or public POC is present in the data, meaning there is no public exploit identified at time of analysis. SSVC Technical Impact of 'total' is consistent with the full-impact CVSS metrics. No EPSS score was provided, so statistical exploitation probability cannot be assessed. Net: a genuine EoP worth patching in routine cycles as a post-compromise escalation vector, but not an emergency given no evidence of exploitation and the requirement for pre-existing local access. Primary value is to a chained attacker converting a limited foothold into SYSTEM.

An attacker who has already gained a low-privileged authenticated session on a Windows host (e.g., via phishing or stolen credentials) runs a crafted program that interacts with the Smart Card component to trigger a heap-based buffer overflow. Successful exploitation corrupts heap memory to execute code at elevated privilege, escalating from a standard user to SYSTEM. No public exploit code is identified at time of analysis, so a working exploit would need to be developed.