Windows Search CVE-2026-96324

The attacker must already possess local, authenticated low-privileged access to the target Windows host (PR:L, AV:L) and be able to run code that exercises the Windows Search Component (the Windows Search indexing/query service, which is enabled by default on client Windows and present across the listed Server SKUs). No user interaction is required (UI:N) and attack complexity is low (AC:L), so once local code executes, no special non-default configuration is needed. The primary limiting factor is the local-access prerequisite: this cannot be exploited remotely or by an unauthenticated attacker, making it a post-compromise privilege-escalation primitive rather than an initial-access vector. Affected builds are those below the fixed versions listed in EUVD (e.g., Windows 11 24H2 below 10.0.26100.9711, Server 2025 below 10.0.26100.33650); patched builds remove the condition.

This is a credible patch-priority item but not an emergency. The CVSS 3.1 vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) describes a local privilege-escalation path: the attacker must already have local, low-privileged code execution (PR:L, AV:L), but complexity is low (AC:L) and no user interaction is needed (UI:N), with full confidentiality, integrity and availability impact on the host. No EPSS score, KEV entry, or public PoC was provided in the input, so the exploitation signal is: no public exploit identified at time of analysis - not CISA KEV and not independently confirmed as exploited. Use-after-free kernel/component EoP bugs in Windows historically become reliable exploitation targets and are frequently chained after initial access, so the latent risk is higher than the absence of a PoC suggests, but there is no evidence of in-the-wild use here. Conflicting/missing signals to note explicitly: EPSS and PoC status are absent from the input (cannot confirm either way), and the input Tags include 'Denial Of Service' which is only partially consistent with a full C:H/I:H/A:H elevation-of-privilege UAF - treat the DoS label as a secondary/possible outcome rather than the primary impact. Net: a real but routine high-severity local EoP to patch on the normal expedited Windows cadence, not a drop-everything network-exploitable issue.

An attacker who already has a low-privileged foothold on a Windows host (e.g., via a standard user account, a compromised service, or a malware dropper) runs code that triggers the use-after-free in the Windows Search component to corrupt memory and hijack execution in a higher-privileged context. Because the CVSS vector is local (AV:L) with low attack complexity and no user interaction, exploitation is deterministic once code runs on the box, but it cannot be launched remotely without prior access. No public exploit was identified in the provided data, so weaponization effort is unknown.