Windows SSTP EUVD-2026-100095

Exploitation requires the attacker to already have local, authenticated access to an affected Windows host at a low privilege level (PR:L, AV:L) - there is no remote or unauthenticated path and no user interaction is needed (UI:N). The vulnerable surface is the Windows Secure Socket Tunneling Protocol (SSTP) component; the attacker must be able to reach and drive its heap-handling code path from their local session. Limiting factors: the need for a pre-existing local foothold and valid (even if low-privileged) credentials means this functions as a privilege-escalation chain link rather than an entry point, and risk is concentrated on multi-user, terminal/RDP, and server systems where untrusted local principals exist; single-user, fully-trusted endpoints face lower practical exposure.

Signals align consistently toward a moderate-but-real priority rather than an emergency. The CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) describes a local privilege-escalation flaw: the attacker must already have local, authenticated access with low privileges (PR:L), after which low attack complexity and full C/I/A impact make successful exploitation reliable. No EPSS score, KEV listing, or public POC is present in the provided data, so there is no evidence of active exploitation or widespread weaponization - exploitation status is therefore 'no public exploit identified at time of analysis.' There is no conflict between the CVSS vector and the description: both point to local elevation of privilege, not remote compromise. The practical risk is as a second-stage escalation primitive (e.g., after phishing, a web shell, or a low-priv foothold) rather than an initial-access vector. Given Microsoft reported it internally (secure@microsoft.com) and a patch is already available, this is a routine-but-important Patch Tuesday-class EoP: prioritize for multi-user, RDP, and server hosts where untrusted local users exist, but it is not a drop-everything network-exploitable issue.

A low-privileged but authenticated local user (or malware running in a low-priv context after initial access) invokes the vulnerable SSTP code path and supplies crafted input that overflows a heap buffer, corrupting memory in a higher-privileged service/kernel context. Because the attack vector is local with low complexity (AV:L/AC:L), exploitation is reliable once the attacker has any foothold, letting them escalate to SYSTEM. No public exploit code is identified at time of analysis, so this currently requires attacker-developed tooling.