Windows Immersive Server CVE-2026-85905

Exploitation requires the attacker to already hold a local, authenticated low-privileged account on the target Windows system (CVSS PR:L, AV:L) - there is no remote or unauthenticated path. The attacker must be able to execute a process that reaches and sends crafted input to the Windows UI Immersive Server component to trigger the heap overflow; no end-user interaction is required (UI:N). Limiting factors: local access prerequisite and an existing authenticated foothold, which is why CISA SSVC rates it Automatable: no (not mass-exploitable). The affected product is any supported Windows edition below the fixed build (e.g., Windows 11 24H2 < 10.0.26100.9711, Windows Server 2025 < 10.0.26100.33650, down to Windows 10 1607 and Server 2012); patched builds are not exploitable.

Signals are largely consistent and point to a serious but not emergency-grade local privilege-escalation flaw. The CVSS 3.1 base score of 8.8 is driven by AV:L (local attack vector), AC:L (low complexity), PR:L (an already-authenticated low-privileged foothold is required), UI:N, and a changed scope (S:C) with total C:H/I:H/A:H impact - consistent with escalation to SYSTEM on a successful heap overflow of the Windows UI Immersive Server. CISA's SSVC framework reinforces this read: Technical Impact is 'total' (matching C:H/I:H/A:H), but Exploitation is 'none' (no observed or public exploitation) and Automatable is 'no' (local, authentication-gated, so it cannot be mass-scanned/wormed). There is no CISA KEV listing and no POC reported, so exploitation status is 'no public exploit identified at time of analysis.' No EPSS score was supplied in the input, so probabilistic exploitation likelihood could not be weighed; absence of EPSS is a data gap, not a low score. Net: this is a real priority for Windows fleets because the affected footprint is enormous and a patch exists, but the local + PR:L requirement means it is a post-compromise escalation primitive rather than a remotely wormable threat - prioritize for patching on privilege-boundary-sensitive hosts, but it is not a drop-everything internet-facing emergency. No signals conflict; the main caveat is the missing EPSS value.

An attacker who already has a low-privileged authenticated session on a Windows host (e.g., via phishing, a stolen standard-user credential, or a compromised service account) runs a crafted process that sends malformed input to the UI Immersive Server component, triggering the heap-based buffer overflow. Successful exploitation corrupts heap memory to execute attacker-controlled code at elevated (SYSTEM) privilege, breaking out of the original security context (scope change). No public exploit code or active exploitation has been identified at the time of analysis.