Microsoft PowerToys CVE-2026-96188

Requires the attacker to already have authenticated low-privileged local access to the host (PR:L) and the ability to manipulate an externally-controlled PowerToys configuration setting (CWE-15). Exploitation additionally depends on user interaction (UI:R) - a legitimate or privileged user/process must consume the tampered configuration for escalation to occur - which is the primary limiting factor. It is local-only (AV:L), so it cannot be triggered remotely or by an unauthenticated attacker, and it is bounded to systems where Microsoft PowerToys versions 0.1 up to but not including 0.101.2632.0 are installed and in use.

This is a locally-exploitable elevation-of-privilege flaw (CWE-15, external control of configuration setting) in Microsoft PowerToys with a vendor-assigned CVSS 7.3. The CVSS vector (AV:L/AC:L/PR:L/UI:R) is internally consistent with a local EoP: the attacker must already have low-privileged local access, exploitation is low-complexity, but it requires user interaction (UI:R), which meaningfully limits automated/remote mass exploitation. Impact is high across confidentiality, integrity, and availability (C:H/I:H/A:H), consistent with gaining elevated privileges. No EPSS score, no CISA KEV listing, and no POC indicator are present in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation - this reads as a credible but not emergency priority. The real-world risk is moderate: it is a privilege escalation requiring prior local foothold and user interaction, not an unauthenticated remote compromise, so it is best treated as a patch-in-normal-cycle item unless PowerToys runs on high-value multi-user hosts. Note a data conflict: the 'Information Disclosure' tag contradicts the description (elevation of privileges) and the full-triad CVSS impact, so that tag appears mislabeled.

A low-privileged local user who can influence an externally-controlled PowerToys configuration setting plants a malicious value, then induces a higher-privileged user (or triggers a privileged PowerToys component) to act on it. When that configuration is consumed, the attacker's input causes execution in a higher privilege context, elevating the attacker from standard user toward administrator/SYSTEM. No public exploit code is identified at time of analysis, and the UI:R requirement means the attack hinges on a user action to complete.