Windows Shell CVE-2026-83873

Exploitation requires the attacker to already have authenticated low-privileged local access to the Windows host (PR:L, AV:L) - it cannot be triggered remotely or by an unauthenticated actor. The specific prerequisite is the ability to supply a crafted relative path to a privileged Windows Shell operation so that path-traversal sequences redirect it outside the intended directory (CWE-23). No user interaction is needed (UI:N) and default configurations of the listed Windows client and server builds are affected, so there is no special feature-enablement condition; the primary limiting factor is the need for prior local code execution as a normal user. Hosts patched to the fixed builds in the EUVD list (e.g., Windows 11 24H2 >=10.0.26100.9711, Server 2025 >=10.0.26100.33650) are not exploitable.

This is a genuine patch-priority item but not an emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8 High) describes a local privilege-escalation flaw: the attacker must already be able to execute code on the host as a low-privileged user (PR:L), but once there, exploitation is low-complexity (AC:L), needs no user interaction (UI:N), and yields full confidentiality/integrity/availability impact (total technical impact, confirmed by SSVC). All exploitation signals point AWAY from urgency: SSVC reports Exploitation=none and Automatable=no, there is no CISA KEV listing, and no public exploit was identified - consistent with the 'authorized attacker ... locally' language in the description. The signals are internally consistent (local vector matches 'locally'; PR:L matches 'authorized attacker'), so there is no contradiction to flag. The main caveat is that EPSS was not provided in the input, so probabilistic exploitation likelihood cannot be weighed. Net: treat as a standard Patch-Tuesday-class local EoP - important for hardening against post-compromise escalation on the ubiquitous Windows base, but it is not remotely exploitable and shows no current exploitation, so it ranks below any network-facing or actively-exploited bug in patch sequencing.

A low-privileged user (or malware already running in a low-integrity context) on a Windows host invokes Windows Shell functionality with a crafted relative path containing traversal sequences, causing a privileged Shell operation to act on an attacker-controlled location and run attacker code with elevated privileges. No public proof-of-concept exists at this time, and because the CVSS vector is AV:L the attacker needs prior local code-execution access before escalating to SYSTEM-level control.