Microsoft Windows Search CVE-2026-96937

Exploitation requires the attacker to already have a valid low-privileged local logon session on the target Windows host (PR:L) and to locally interact with the Windows Search Component; there is no network vector and no user interaction is needed (AV:L, UI:N). The key limiting factor is High attack complexity (AC:H): use-after-free exploitation here depends on winning a race/timing window and controlling heap reuse of the freed object, making reliable exploitation conditions-dependent rather than one-shot. Hosts patched to the fixed per-SKU builds (e.g. Windows 11 24H2 >=10.0.26100.9711, Server 2025 >=10.0.26100.33650) are not affected.

This is a genuine but non-emergency privilege-escalation issue rather than a top-priority external threat. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U) confirms a local-only attack requiring the attacker to already hold a low-privileged authenticated session on the host, and the High attack complexity (AC:H) signals a non-trivial precondition - typical of use-after-free races that depend on winning a timing window or grooming heap state, which reduces reliability. The C:H/I:H/A:H impact justifies the 7.0 (High) score because successful exploitation yields full SYSTEM-level compromise. No EPSS score, no CISA KEV listing, and no public POC were supplied, so there is no evidence of active exploitation or widespread weaponization; exploitation status is best treated as theoretical at analysis time. The input Tags include 'Denial Of Service,' which is inconsistent with the description's stated impact of local privilege elevation - the CVSS impact set (C/I/A all High) and CWE-416 point to code execution / EoP as the primary outcome, so defenders should treat EoP, not DoS, as the real risk; verify intent with Microsoft's MSRC advisory.

A low-privileged user (or malware already running under a standard account) on a Windows host executes a crafted sequence against the Windows Search Component to trigger a use-after-free, winning the timing/heap race required by the High attack complexity. By reclaiming the freed object with attacker-controlled data, they redirect execution and elevate from a normal user to SYSTEM. No public exploit code was identified at analysis time, so this would require independent exploit development.