Windows Search CVE-2026-96910

Exploitation requires local code execution on the affected host as an authenticated low-privileged user (PR:L), targeting the Windows Search Component (the indexing/search service present by default on Windows). No victim user interaction is needed (UI:N) and no special non-default feature must be enabled - the Search Component is a standard Windows service. The principal limiting factors are the local attack vector (AV:L), meaning no remote network exploitation is possible, and the requirement for prior authenticated access, so the flaw cannot be used for initial remote compromise and is realistically a post-foothold memory-disclosure capability. Impact is confined to confidentiality (reading memory); it grants no integrity or availability effect.

This is a moderate-severity local information disclosure flaw (CVSS 5.5) in the Windows Search Component, and the signals are consistent and point toward low real-world urgency. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U) confirms the attacker must already have local access and low-level privileges (an authenticated user), limiting reach to attackers with an existing foothold. The CISA SSVC decision framework reinforces this: Exploitation is 'none' (no observed exploitation), Automatable is 'no' (cannot be reliably scripted at scale), and Technical Impact is 'partial' - aligning with the single high-confidentiality, no-integrity, no-availability impact (C:H/I:N/A:N). There is no CISA KEV listing, no public POC, and no EPSS score was supplied in the input. No signals conflict. In practice this is a high-ubiquity-product but low-real-risk issue best treated as a routine patch-cycle item rather than an emergency, though its presence on nearly every Windows host warrants eventual remediation given it could serve as a post-compromise information-gathering primitive.

An attacker who already has low-privileged authenticated access to a Windows host (for example via a standard user account or an initial foothold) runs a crafted local process that triggers an untrusted pointer dereference in the Windows Search Component, causing it to read and disclose memory contents the attacker should not be able to see. No public exploit code has been identified, and the attack requires local access with no user interaction from a victim.