Microsoft IME CVE-2026-88101

Exploitation requires the attacker to already possess a local, authenticated foothold on the Windows host (PR:L) and to interact with the Input Method Editor component; there is no remote or network vector (AV:L) and no user interaction is needed (UI:N). The limiting factor is the prerequisite of an existing low-privileged session, which makes this a post-compromise escalation rather than an initial-access flaw; risk is elevated on shared/multi-user systems (RDP/terminal servers, kiosks) where many low-privileged users have local access. All currently supported Windows editions below the fixed build numbers in the EUVD data are affected; patching to the listed build (e.g. 10.0.26100.9711 for Windows 11 24H2) removes the condition.

This is a locally exploitable elevation-of-privilege flaw (CVSS 7.8, AV:L/AC:L/PR:L/UI:N) stemming from weak authentication (CWE-1390) in the Microsoft Input Method Editor. The signals are internally consistent but point to a moderate rather than urgent priority: the CVSS vector requires local access and already-held privileges (PR:L), meaning an attacker must first have an authenticated foothold on the host. SSVC reinforces this - exploitation status is 'none' and the flaw is 'not automatable,' arguing against mass or wormable exploitation, even though the technical impact is rated 'total' (matching C:H/I:H/A:H). There is no CISA KEV listing and no public exploit was identified at the time of analysis, so there is no evidence of active exploitation. The practical risk is that of a classic post-compromise privilege-escalation primitive: valuable to an attacker who already has a low-privileged session (and highly relevant on multi-user or RDP/terminal-server hosts) but not a remote entry point. Note one metadata conflict worth verifying: the input Tags include 'Information Disclosure,' yet the description, CWE, and high integrity/availability impacts all describe local privilege elevation, not disclosure - treat the EoP characterization, not the tag, as authoritative.

An attacker who already has a low-privileged authenticated session on a Windows host (for example a standard user, or a user connected to a shared terminal/RDP server) abuses weak authentication in the Input Method Editor to escalate to SYSTEM-level privileges. Because exploitation is local and requires no user interaction, it is most useful as a second stage after an initial foothold is gained through other means. No public proof-of-concept was identified at the time of analysis.