Windows EAPHost Service CVE-2026-84016

Exploitation requires the attacker to already hold an authenticated low-privilege local session on the target Windows host (PR:L), and to be able to execute code locally that interacts with the EAPHost Service (the Extensible Authentication Protocol host service used for 802.1X / network authentication). No user interaction is needed (UI:N) and attack complexity is low (AC:L), but the strict AV:L constraint means it cannot be triggered remotely over the network - it is a post-foothold escalation. The primary limiting factors are the need for prior local access and valid (even if unprivileged) credentials; there is no indication a special non-default configuration is required, as EAPHost is a standard Windows component.

This is a credible, patch-now-class local privilege escalation but not a drop-everything emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N) is internally consistent with the description: an already-authorized local user triggers an out-of-bounds write (CWE-787) in the Windows EAPHost Service to gain full C:H/I:H/A:H impact - effectively SYSTEM-level control. The CVSS vector and description agree (both indicate local, authenticated exploitation), so there is no signal conflict here. CISA's SSVC framework reinforces a measured priority: Exploitation=none (no observed or public exploitation), Automatable=no (consistent with a local EoP requiring an existing foothold, not mass-scannable), but Technical Impact=total (matching the C/I/A:H impact). No EPSS score was provided in the input, and there is no CISA KEV listing and no POC indicator - so there is no public exploit identified at time of analysis. Net: this is a legitimately serious memory-corruption EoP (total technical impact) that an attacker would chain AFTER initial access, but the absence of exploitation evidence and the non-automatable, local-only nature make it a high-priority patch rather than an actively-exploited crisis.

An attacker who already has a low-privileged authenticated session on a Windows host (via phishing, stolen credentials, or a prior exploit) runs a crafted local program that sends malformed input to the EAPHost Service, triggering an out-of-bounds write that corrupts memory and elevates them to SYSTEM. No user interaction is required and attack complexity is low (AC:L), but exploitation is strictly local and requires an existing foothold. No public exploit code was identified at time of analysis.