Windows SSPI CVE-2026-88098

Requires a local, authenticated low-privileged session on the Windows host (AV:L, PR:L) - the attacker must already be able to run code on the machine, so this is a second-stage escalation primitive, not an initial-access or remote bug. The flaw is in the Security Support Provider Interface (SSPI) and is triggered by supplying an untrusted/attacker-controlled pointer that the component dereferences (CWE-822). LIMITING FACTORS: high attack complexity (AC:H) indicates a non-deterministic trigger such as a race condition or a precise memory layout that the attacker must reliably achieve, materially reducing exploit reliability; no user interaction is needed (UI:N) and scope is unchanged (S:U). Applies to default configurations across the broad list of affected Windows 10/11, Windows Server 2012 R2 through 2025, and Server Core installations below the fixed build numbers in the EUVD data.

Signals are largely consistent and point to a genuine but second-tier priority rather than an emergency. The Microsoft-supplied CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N) describes a local privilege-escalation flaw requiring an authenticated foothold and a high-complexity trigger - not a remotely reachable or trivially automatable issue. CISA's SSVC framing reinforces this: Exploitation 'none' (no observed or public exploitation) and Automatable 'no', which caps real-world urgency, even though Technical Impact is rated 'total' (consistent with the C:H/I:H/A:H full-SYSTEM compromise once triggered). There is no CISA KEV listing and no POC indicator in the input, so this is not confirmed active exploitation. EPSS is not provided, so probabilistic exploitation likelihood cannot be factored in - STATE EXPLICITLY: no EPSS score was supplied. One data inconsistency: the input Tags include 'Information Disclosure', but the description and CVSS both describe an elevation-of-privilege (untrusted pointer dereference, CWE-822) issue - treat the tag as suspect, not the vector. Net: a high-impact-if-exploited local EoP that is valuable to an attacker already on the host (second-stage privilege escalation), but the AC:H trigger and lack of exploitation evidence make it a patch-on-normal-cycle item rather than a drop-everything fix for most environments; prioritize on multi-user, RDP, or shared Windows hosts.

An attacker who already has a low-privileged authenticated session on a Windows host (e.g., via phishing or stolen credentials) runs a crafted program that passes an untrusted pointer into the Security Support Provider Interface, causing an invalid dereference that corrupts memory and yields SYSTEM-level code execution. The high attack complexity (AC:H) implies the attacker must win a race or establish a specific memory state, so exploitation is reliable only with a well-engineered tool. No public exploit code is identified at time of analysis.