Windows Search CVE-2026-83704

Requires pre-existing authenticated local access to the target host as a low-privileged user (PR:L, AV:L) and the ability to create filesystem links (symbolic links, junctions, or hard links) in a location the privileged Windows Search component processes; exploitation therefore depends on the Windows Search indexing service being present and active (default on Windows client editions). No remote network access and no user interaction (UI:N) are needed. Limiting factors: the attacker must already have a local foothold, must win or control a file-link-resolution operation performed by the higher-privileged Search process, and exploitation is not automatable per CISA SSVC, making this a post-compromise escalation step rather than an initial-access or wormable vector.

This is a locally-exploitable elevation-of-privilege flaw (CWE-59, link following) in the Windows Search component, rated CVSS 7.8. The vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N indicates an authenticated local attacker with low privileges, low attack complexity, and no user interaction can achieve full confidentiality, integrity, and availability impact (C:H/I:H/A:H) - consistent with SYSTEM-level privilege escalation. All exploitation signals point to a LOWER real-world urgency than the 7.8 base score alone suggests: CISA's SSVC decision framework reports Exploitation=none and Automatable=no, meaning no observed exploitation and no reliable mass-automation, though Technical Impact=total aligns with the complete CVSS impact metrics. The CVE is NOT on the CISA KEV list and no public proof-of-concept is referenced, so there is no public exploit identified at time of analysis. Net assessment: a genuine but routine Patch-Tuesday-class local EoP - valuable as a post-compromise privilege-escalation link in a chain, but not a drop-everything remote threat. Note a data conflict: the input Tag labels this 'Information Disclosure,' yet both the description ('elevate privileges locally') and the full C:H/I:H/A:H impact confirm this is an elevation-of-privilege issue, not mere information disclosure - the tag appears mislabeled.

A low-privileged attacker who already has local code execution on a Windows host (e.g., via phishing or a compromised standard user account) plants a malicious symbolic link or junction that the Windows Search indexing/service process follows while operating with higher privileges. By winning the link-resolution race or redirecting a privileged file operation, the attacker causes a protected file to be written, overwritten, or deleted in a SYSTEM context, yielding full privilege escalation. No public exploit code is currently identified, and because AC:L/UI:N the technique is reliable once local access is obtained.