Windows HID Parser EUVD-2026-100029

Exploitation requires the attacker to already possess local, low-privileged authenticated access to the Windows host (PR:L), from which they submit a maliciously crafted HID (Human Interface Device) report descriptor that the HID Parser Library processes, triggering the CWE-190 integer overflow. No user interaction is needed (UI:N) and complexity is low (AC:L). The principal limiting factor is the local attack vector: there is no remote or network-facing exploitation path, so an attacker must first obtain code execution or an interactive session as any user. The flaw affects default Windows configurations across the listed Windows 10, 11, and Server builds (no special feature toggle is indicated), but realistic risk is bounded to multi-user, kiosk, or post-initial-compromise scenarios where an untrusted principal can reach the HID parsing path.

This is a locally-exploitable elevation-of-privilege flaw in the Windows HID Parser Library. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N) confirms a local attack vector requiring low-privilege authenticated access with low complexity and no user interaction, yielding high confidentiality, integrity, and availability impact (score 7.8). CISA's SSVC decision framework corroborates the severity on impact (Technical Impact: total) but tempers urgency: Exploitation is 'none' (no observed exploitation) and Automatable is 'no', consistent with a local EoP that cannot be sprayed remotely. There is no CISA KEV listing and no public exploit was provided in the input, so per precision rules this is 'no public exploit identified at time of analysis.' Net assessment: a genuine but non-emergency patch priority - real post-compromise value to an attacker who already has a foothold, yet not a mass-exploitation or wormable threat. The signals are internally consistent (local vector + SSVC not-automatable + no KEV all agree), so there is no contradiction to flag; the main limitation is that this is one of a large Windows Patch-Tuesday-style batch and should be prioritized for systems where untrusted local users or low-privilege processes run.

An attacker who has already gained low-privileged code execution on a Windows host (e.g., via a standard user account or a sandboxed process) supplies crafted HID descriptor data that triggers an integer overflow in the HID Parser Library. The resulting memory corruption is leveraged to execute code at SYSTEM, completing a local privilege escalation. No public exploit code was identified at the time of analysis, and no user interaction is required.