Microsoft Scripting Engine CVE-2026-88193

Exploitation requires local code/script execution on the target host and a valid low-privileged account (CVSS PR:L), meaning the attacker must already be authenticated on the machine - this is not remotely exploitable (AV:L). The attacker must get content processed by the Microsoft Scripting Engine to trigger the heap overflow; no victim user interaction is needed (UI:N) and attack complexity is low (AC:L). The key limiting factor is the need for a pre-existing local foothold with credentials, which confines realistic use to post-initial-access privilege escalation; applying the available Microsoft patch removes the condition entirely.

This is a moderate-priority local privilege escalation. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N) confirms the attacker must already have local access and low-level privileges (PR:L, authenticated), but complexity is low and no user interaction is required, with high impact across confidentiality, integrity, and availability (C:H/I:H/A:H) on an unchanged scope. No EPSS score, SSVC decision, or CISA KEV entry was provided, and there is no public exploit identified at time of analysis, so there are no exploitation-probability signals to contrast against the CVSS score. The 7.8 rating is typical of a Windows EoP bug: dangerous as a post-compromise step but not remotely reachable on its own. Because exploitation requires an existing foothold and valid credentials, this is a 'chain-completion' flaw rather than a standalone widespread-exploitation risk; absent EPSS/KEV data, real-world urgency should be treated as elevated only where initial-access vectors already exist (e.g., shared/multi-user hosts or browser-driven script execution). No signals conflict, but the lack of EPSS and KEV data means exploitation likelihood is unquantified from the input.

An attacker who already has a low-privileged foothold on a Windows host (e.g., via phishing or a compromised standard user account) runs or triggers malicious script content processed by the Microsoft Scripting Engine, corrupting the heap to overwrite control data. Exploiting the overflow, they execute code at a higher privilege level to take full control of the system. No public exploit code was identified at time of analysis.