Windows Search EUVD-2026-100014

Requires the attacker to already have local, authenticated low-privilege code execution on the target Windows host (PR:L), such as an interactive or service account foothold; the Windows Search Component (a default-present OS feature across supported Windows 10/11 and Windows Server editions) is the attack surface. No user interaction is needed (UI:N) and attack complexity is low (AC:L). The primary limiting factor is the local-only vector (AV:L) - there is no remote or network path - so this flaw is a post-compromise escalation step rather than an entry point, and systems are protected once the vendor update (e.g., builds such as 10.0.26100.9711 for 24H2) is applied.

This is a credible but not emergency-tier priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N) describes a local privilege-escalation flaw requiring an attacker who already holds low-level authenticated access to the host; it is not remotely exploitable, which bounds its real-world urgency. Signals are internally consistent and point to a moderate threat: CISA's SSVC framework reports Exploitation 'none' and Automatable 'no' (so no observed exploitation and no reliable mass-automation path), while Technical Impact is 'total' - matching the C:H/I:H/A:H full-system-compromise outcome of a successful SYSTEM-level escalation. No KEV listing and no POC are present in the provided data, so there is no evidence of active exploitation or public exploit code. EPSS was not supplied, which is a data gap rather than a low score; absence should not be read as low probability. Net: this is a standard-cadence patch priority - high technical impact if chained with initial access, but gated behind existing local authentication and not currently exploited. Verify EPSS and monitor KEV, as Windows Search EoP bugs are historically attractive post-compromise primitives.

A low-privileged authenticated user (or malware running in a standard user context after initial access via phishing or a separate bug) executes a crafted interaction with the Windows Search Component that triggers a heap-based buffer overflow, corrupting heap memory to hijack execution in a higher-privileged context and gain SYSTEM privileges. Because the CVSS vector is AV:L/AC:L/PR:L/UI:N, exploitation is local, low-complexity, and needs no victim interaction once the attacker has a foothold. No public exploit code was identified at time of analysis, so weaponization would require independent development.