Windows WinINet EUVD-2026-100013

Exploitation requires an existing authenticated, low-privileged local session on the affected Windows host (AV:L, PR:L) - this is not remotely reachable and cannot be triggered by an unauthenticated network attacker. No user interaction is needed (UI:N) and complexity is low (AC:L), so once local access is held, exploitation is straightforward. The limiting factors are therefore the local-access and prior-privilege prerequisites: an attacker must already have a foothold on the machine. Affected are specific builds across Windows 10 (21H2/22H2), Windows 11 (23H2 through 26H2 and 26H1), and Windows Server 2022/2025 below the patched build numbers listed in EUVD-2026-100013; hosts updated to or above those build thresholds are not exploitable.

This is a CVSS 8.4 (High) improper-privilege-management/spoofing flaw (CWE-290) in Windows' WinINet component (wininet.dll). The signals pull in different directions and should temper triage urgency. The CVSS vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N indicates a LOCAL attack vector requiring low-level privileges (PR:L, i.e. an authenticated foothold), but with low complexity, no user interaction, a scope change (S:C), and high confidentiality and integrity impact - the high score is driven largely by the scope change and dual H impacts rather than by remote reachability. CISA's SSVC framework reinforces a measured posture: Exploitation is assessed as 'none', Automatable is 'no', while Technical Impact is 'total'; high damage potential but no evidence of active or scalable exploitation. There is no CISA KEV listing and no public proof-of-concept in the provided data, so exploitation status is 'no public exploit identified at time of analysis'. The combination - local vector + required privileges + not automatable + no observed exploitation - means this is NOT an emergency internet-facing drop-everything issue, but it IS a meaningful privilege/spoofing primitive worth prompt patching given Windows' ubiquity and the vendor-rated total technical impact. Note one tension to verify: CVSS marks C:H and I:H for what the description frames as 'spoofing', which for a CWE-290 issue typically centers on integrity/identity rather than confidentiality disclosure - the high confidentiality rating is plausible via the scope change (e.g. impersonation enabling access to another security context) but should be confirmed against the Microsoft advisory.

An attacker who already has a low-privileged authenticated session on a Windows host locally abuses the improper privilege management in wininet.dll to spoof a trusted identity or security context, crossing a security boundary (scope change) to act as or impersonate another principal. Because the vector is local and requires existing privileges with no user interaction, the realistic path is post-compromise privilege/identity escalation rather than initial remote access. No public exploit code is identified at time of analysis.