Windows Registry CVE-2026-83927

Exploitation requires the attacker to already possess authenticated, low-privileged local code execution on the target Windows host (PR:L, AV:L) - it is not remotely or anonymously reachable. The attacker must be able to create or control a symbolic link, junction, or similar filesystem/Registry link object and induce a higher-privileged Windows Registry operation to follow it (CWE-59 link following), typically by winning a resolution race. No user interaction by a victim is needed (UI:N). Limiting factors: the requirement for prior local foothold, the need to manipulate link objects a privileged process will resolve, and that unpatched builds below the fixed versions (e.g., Windows 10 22H2 <10.0.19044.7807, Windows 11 24H2/25H2 <10.0.26100.9711/<10.0.26200.9711, Server 2022 <10.0.20348.5761, Server 2025 <10.0.26100.33650) must be running; patched systems are not vulnerable.

This is a credible but not emergency-level priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) describes a local elevation-of-privilege flaw requiring an attacker to already have low-privileged code execution on the host; it is not remotely reachable. CISA's SSVC framework aligns with a measured response: Exploitation=none (no observed activity), Automatable=no (cannot be mass-scripted at scale), Technical Impact=total (full compromise of the affected system once triggered). No KEV listing and no public POC were provided, so under the precision rules this is 'no public exploit identified at time of analysis.' EPSS was not supplied in the input, so exploitation probability cannot be quantified here. The signals are internally consistent - high technical impact but low ease/likelihood of exploitation - which is typical of a second-stage privilege-escalation primitive used after initial access rather than an internet-facing mass-exploitation risk. Note one metadata conflict: the input Tag labels this 'Information Disclosure,' but the description and CWE-59 (link following) with full C:H/I:H/A:H impact describe a privilege-escalation/integrity flaw, not merely disclosure - treat the tag with caution and verify category against the MSRC advisory.

An attacker who has already gained unprivileged local code execution (e.g., via phishing or a low-privilege service account) plants or manipulates a symbolic link/junction so that a privileged Windows process resolves a Registry-related path to an attacker-controlled target. By winning the resulting link-resolution race or redirection, the attacker causes a high-privilege operation to act on their chosen object, escalating to SYSTEM. No public exploit code was identified at time of analysis, and local access plus the ability to run as an authorized user is required.