Windows Management Instrumentation CVE-2026-96856

Exploitation requires the attacker to already have local, low-privileged code execution on the target host - the CVSS vector is AV:L with PR:L, meaning an authenticated local user account is needed; this is not remotely reachable and requires no victim interaction (UI:N). The condition is interaction with the Windows Management Instrumentation service to deliver the malformed input that overflows the heap buffer. WMI is present and running by default on all supported Windows client and server editions, so no non-default configuration is needed; the primary limiting factor is the prerequisite of prior local access with at least standard-user credentials, which confines this to post-compromise privilege escalation rather than initial access.

This is a locally-exploitable heap-based buffer overflow (CWE-122) in Windows Management Instrumentation with a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The vector is internally consistent: local attack vector, low complexity, and low privileges required (so an authenticated, non-administrative user), with full confidentiality, integrity, and availability impact on an unchanged scope - the classic profile of a privilege-escalation primitive rather than a remote entry point. The signals largely agree that this is a solid but not emergency-tier issue: CISA's SSVC framework reports Exploitation 'none' and Automatable 'no' while rating Technical Impact 'total', which aligns with a powerful-but-local flaw that cannot be sprayed across the internet. No EPSS score was supplied in the input, so exploitation probability cannot be quantified here. There is no CISA KEV listing and no public exploit referenced, so this is not confirmed as actively exploited. Net assessment: a genuine priority to patch in the normal monthly cycle - because the technical impact is total and local EoP is a standard post-compromise step - but not a drop-everything remote threat. Local access with at least low-level credentials is a hard prerequisite that materially limits real-world risk.

An attacker who has already gained a foothold on a Windows host as a standard, low-privileged user runs a malicious program that sends crafted input to the WMI service, triggering the heap-based buffer overflow. Successful exploitation corrupts heap memory to hijack execution and elevate to SYSTEM, giving full control of the machine. No public proof-of-concept was identified at the time of analysis, and the local attack vector with low complexity means no user interaction is required once the attacker has local code execution.