Windows Resource Management CVE-2026-87702

Exploitation requires the attacker to already possess local, authenticated access to the target Windows host with at least low-level privileges (PR:L) - this is a privilege-escalation flaw, not a remote entry point, so a prior foothold is a hard prerequisite. The vulnerable code path lies in Windows Resource Management (MRM); the attacker must be able to supply input that reaches and triggers the integer overflow (CWE-190) in that component. Limiting factors: no remote network vector (AV:L), so it cannot be triggered directly over the network; however, no user interaction is needed (UI:N) and attack complexity is low (AC:L), so once local access is obtained, exploitation is straightforward. Affected systems are those running Windows builds below the patched versions listed in the EUVD data (spanning Windows 10/11, and Windows Server 2012 through 2025); fully patched hosts are not exploitable.

This is a credible but not emergency-tier priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) describes a local privilege-escalation flaw: the attacker must already have local, authenticated access with low privileges (PR:L), no user interaction is required (UI:N), attack complexity is low (AC:L), and successful exploitation yields full confidentiality, integrity, and availability impact on the affected system (C:H/I:H/A:H, scope unchanged). An integer overflow/wraparound (CWE-190) in Windows Resource Management (MRM) consistent with a memory-corruption EoP primitive. No EPSS score, SSVC decision data, KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The CVSS signal and the description are internally consistent (both point to local access), with no contradictions to flag. The practical risk profile is typical of Patch-Tuesday-class Windows local EoP bugs: valuable as a post-compromise or second-stage step for attackers who already have a foothold, rather than an internet-facing initial-access vulnerability. Given Windows' enormous deployment footprint, prioritize routine patching, but this does not demand out-of-band emergency response in the absence of KEV/EPSS/POC signals.

An attacker who has already gained low-privileged code execution on a Windows host (e.g., via phishing, a compromised standard user account, or a prior exploit) invokes the vulnerable Windows Resource Management (MRM) code path with crafted input that triggers an integer overflow, corrupting memory to escalate to SYSTEM-level privileges. No user interaction is required and attack complexity is low. No public proof-of-concept exploit was identified in the provided data.