Windows Hello EUVD-2026-100001

Requires the attacker to already have local, authenticated low-privilege code execution on the target host (AV:L, PR:L) - this is a post-access escalation, not remotely reachable. The use-after-free is in the Windows Hello authentication component, so the affected code path must be present/invokable, and the vulnerable builds are specific Windows 10 (21H2/22H2) and Windows 11 (23H2/24H2/25H2/26H1/26H2) versions below the patched builds (e.g. <10.0.26100.9711 for 24H2). AC:H is the key limiting factor: successful exploitation depends on winning a non-deterministic race / precise memory-reuse timing, so attempts are not guaranteed and may require repetition. No user interaction is needed (UI:N). Systems already patched to the fixed build (e.g. 26100.9711, 26200.9711, 19044.7807, 22631.7652, 28000.3231, 26300.9711) are not exploitable.

This is a genuine but moderate-priority issue rather than a drop-everything emergency. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0 High) describes a local, authenticated privilege-escalation requiring high attack complexity - consistent with a use-after-free (CWE-416) that depends on winning a race or grooming freed memory, not a trivially repeatable primitive. All three exploitation signals point the same direction and are mutually consistent: CISA SSVC lists Exploitation as 'none' and Automatable as 'no', there is no CISA KEV listing, and no public exploit was identified, so there is no evidence of active exploitation or mass-exploitable automation. The one signal pulling upward is SSVC Technical Impact 'total,' which matches the C:H/I:H/A:H full compromise of the local system (EoP to SYSTEM). The practical risk profile is therefore a post-compromise escalation tool: an attacker already executing code as a low-privileged local user could elevate, but AC:H and the need for prior local access substantially limit widespread, opportunistic abuse. Note a metadata inconsistency to verify: the input Tags include 'Denial Of Service,' yet the description and CVSS impacts describe privilege elevation (full C/I/A), not a DoS - treat the DoS tag as likely noise from the memory-corruption class rather than the actual outcome. No EPSS score was supplied, so statistical exploitation probability could not be incorporated.

A low-privileged attacker who already has local code execution on a Windows endpoint (for example via a phished user account or a compromised service) triggers a use-after-free in the Windows Hello component to corrupt kernel/privileged memory and elevate to SYSTEM. Because AC:H applies, the attacker must reliably win a timing/allocation race, so exploitation typically requires repeated attempts or a crafted memory-grooming harness. No public exploit code was identified at the time of analysis, and SSVC marks exploitation as not observed and not automatable.