Windows Search EUVD-2026-100108

Exploitation requires local access to an affected Windows host AND an existing low-privilege authenticated context (PR:L) from which the attacker can invoke the Windows Search indexing/query component to trigger the use-after-free; no user interaction is required (UI:N). The Windows Search component is present and enabled by default across supported Windows client and server builds, so no non-default configuration is needed to reach the vulnerable code. The key limiting factor is that the attacker cannot reach this flaw remotely or unauthenticated - they must first gain code execution or an interactive/standard user session on the target (via phishing, stolen credentials, a sandboxed process, or chaining from another bug), which confines it to a post-foothold privilege-escalation step on the specific builds listed below the fixed versions in EUVD-2026-100108.

This is a credible but not emergency-level priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8 HIGH) describes a local privilege-escalation flaw: the attacker must already have low-privilege authenticated access to the host (PR:L), execution is local (AV:L), low complexity (AC:L), and no user interaction is needed. CWE-416 (use-after-free) in the Windows Search component matches the C:H/I:H/A:H total technical impact, consistent with the SSVC 'Technical Impact: total' rating. However, multiple signals point toward LOW immediate urgency: SSVC 'Exploitation: none' indicates no observed exploitation, 'Automatable: no' indicates it cannot be reliably mass-exploited (typical of memory-corruption EoP requiring a prior foothold), there is no CISA KEV listing, and no public exploit or POC is referenced in the provided data. EPSS score was NOT provided in the input, so exploitation probability cannot be quantified here. The high base score is driven by impact, not by ease of remote reach - this is a post-compromise escalation primitive, not an internet-facing entry point. Priority should be standard Patch-Tuesday cadence, elevated on multi-user or shared hosts where low-privilege users are untrusted.

An attacker who already holds a low-privileged foothold on a Windows system (e.g., a standard user account, a sandboxed process, or post-phishing code execution) locally triggers the use-after-free condition in the Windows Search component to corrupt memory and hijack execution flow, elevating to SYSTEM. No public exploit code is identified at time of analysis, and SSVC records no observed exploitation. Because AV:L and PR:L are required, this is a second-stage escalation step rather than an initial access vector.