Windows RPC Runtime EUVD-2026-100045

Requires the attacker to already possess low-privileged authenticated local access to the Windows host (AV:L, PR:L) and to exploit the RPC Runtime code path that releases an invalid pointer/reference (CWE-763). Exploitation is materially limited by high attack complexity (AC:H) - consistent with a race or timing-dependent condition that is not reliably repeatable - and by the need for a pre-existing local foothold; it cannot be triggered remotely or by an unauthenticated user. No user interaction is required (UI:N), and scope is unchanged (S:U), so success yields local SYSTEM-level escalation on the same host rather than cross-component impact.

Signals are consistent and point to a genuine but non-urgent priority. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0 HIGH) describes a local, authenticated privilege-escalation requiring an already-foothold attacker and a high-complexity (likely race/timing-dependent, per CWE-763 release of invalid pointer) trigger. CISA SSVC reinforces lower urgency: Exploitation=none and Automatable=no, while Technical Impact=total aligns with the full C:H/I:H/A:H impact of a successful SYSTEM-level escalation. There is no CISA KEV listing and no POC referenced, so this is no public exploit identified at time of analysis - not active exploitation. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified here. The AC:H plus Automatable=no combination argues against reliable mass exploitation, consistent with a bug that would be chained by a motivated attacker who already has code execution rather than used for initial access. Net: a real patch-worthy EoP for defense-in-depth, but not a drop-everything emergency absent evidence of exploitation.

An attacker who has already gained low-privileged authenticated code execution on a Windows host (e.g., via phishing or a separate initial-access bug) locally invokes the vulnerable RPC Runtime path and wins a timing-sensitive condition that causes an invalid pointer/reference to be released, corrupting memory to elevate to SYSTEM. The high attack complexity (AC:H) means the race may require multiple attempts, and no public exploit code is currently identified, so this is most plausible as a post-compromise escalation step.