Windows Search CVE-2026-88191

Requires the attacker to already possess authenticated local access (PR:L) to an affected Windows host - this is a privilege-escalation primitive, not a remote entry point. The attacker must be able to create filesystem links (symbolic links, junctions, or hardlinks) and win a race/timing window in which the Windows Search Component (which indexes files with elevated privileges) resolves the attacker-controlled link during a privileged file operation (CWE-59 link following). No user interaction by a victim is needed (UI:N). Limiting factors: exploitation is impossible without a prior local foothold, the Search/indexing service must be running and processing a location the attacker can influence, and the host must be at a build below the fixed version. SSVC Automatable=no indicates the flaw is not readily chained into automated/wormable attacks. Multi-user systems (RDS/terminal servers, shared workstations) are the most realistic targets.

This is a credible but not emergency-level priority. The CVSS 7.8 (HIGH) rating is driven entirely by local impact: AV:L/AC:L/PR:L/UI:N with total C:H/I:H/A:H impact, meaning an already-authenticated local user can gain SYSTEM-level privileges via a link-following (CWE-59) flaw in the Windows Search Component. The exploitation signals are consistent and point AWAY from widespread risk: SSVC reports Exploitation=none and Automatable=no, there is no CISA KEV listing, and no public exploit was identified at time of analysis - so this is not confirmed actively exploited. SSVC Technical Impact=total aligns with the CVSS C:H/I:H/A:H, confirming full compromise IS possible once the preconditions are met. The key mitigating factor is that this requires local, authenticated access (PR:L) as a foothold - it is not remotely exploitable and cannot be used for initial access. No EPSS score was provided in the input, so exploitation probability cannot be quantified. Net assessment: treat as a standard Patch-Tuesday elevation-of-privilege fix - important for multi-user hosts and as a post-exploitation escalation primitive, but not a drop-everything issue absent any exploitation evidence.

A low-privileged attacker who already has local access (e.g. via phishing foothold, a compromised service account, or a shared terminal/RDS host) plants a malicious symbolic link or junction that the Windows Search Component follows while operating with elevated privileges, redirecting a privileged file operation to a target the attacker controls. This lets them overwrite or access protected files and escalate to SYSTEM. No public exploit code was identified at time of analysis, and SSVC rates exploitation as none.