Windows Fax Service CVE-2026-87707

Requires the Windows Fax and Scan Service to be present and reachable by the attacker's local session; exploitation demands prior local access as an authenticated low-privileged user (PR:L, AV:L) who can invoke the service. Limiting factors: no remote network vector exists, so the attacker must already have a foothold on the host; impact is confined to the local machine (S:U, no scope change). No special user interaction is needed (UI:N) and attack complexity is low (AC:L). Hosts where standard users cannot reach the Fax and Scan Service, or where it is disabled/removed, are not exposed.

This is a credible but second-tier priority: a CWE-122 heap-based buffer overflow in the Windows Fax and Scan Service yielding local privilege elevation. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) is internally consistent with the description - local attack vector, low attack complexity, and low privileges required (an authenticated standard user), with total CIA impact on the host once exploited. Multiple signals argue AGAINST treating this as an emergency: it is NOT listed in CISA KEV, no public proof-of-concept is identified, and CISA's SSVC assessment explicitly rates Exploitation as 'none' and Automatable as 'no'. The one signal pointing to high consequence is SSVC Technical Impact 'total', which aligns with the C:H/I:H/A:H full-SYSTEM-compromise outcome. No EPSS score was provided, so exploitation probability cannot be quantified. Net: a genuine local EoP worth patching in routine cycles (and faster on multi-user or shared hosts), but the absence of KEV listing, POC, and automatability means it is not a drop-everything issue. Note the signals are not conflicting - all sources agree exploitation is local and not yet observed in the wild.

An attacker who already has a low-privileged authenticated session on a Windows host (e.g., via phishing, stolen credentials, or an initial foothold) runs a crafted local program that triggers the heap-based buffer overflow in the Fax and Scan Service to corrupt memory and execute code in the service's higher-privilege context. No user interaction is required and attack complexity is low, but the attacker must first have local code execution as some user. No public exploit code is identified at time of analysis.