Windows WalletService EUVD-2026-100211

Exploitation requires an authenticated local attacker (PR:L) with the ability to execute code and create or manipulate filesystem links (symbolic/junction/hard links) that the Windows WalletService resolves during a privileged file operation (CWE-59). The service must be present and running - it ships enabled across supported Windows 10, Windows 11 (21H2 through 26H2), and Windows Server 2016-2025 builds listed in EUVD. Limiting factors: no remote vector (AV:L), the attacker must already possess a local low-privilege foothold, and success depends on winning a link-resolution timing window against the service, which makes exploitation manual and non-automatable (SSVC Automatable: no). No user interaction is required (UI:N).

This is a moderate-priority local elevation-of-privilege flaw, not an emergency. The CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects high confidentiality, integrity, and availability impact, but the attack vector is strictly local and requires the attacker to already hold valid low-level privileges (PR:L) - so this is a post-compromise privilege-escalation primitive, not an initial-access or remote vector. CISA's SSVC framework reinforces a lower urgency: Exploitation is rated 'none' (no observed or public exploitation), Automatable is 'no' (link-following races against a local service are not mass-scannable or wormable), while Technical Impact is 'total' (consistent with full SYSTEM-level compromise). No EPSS score, KEV listing, or POC was provided in the input, so there is no signal of active or probable near-term exploitation. The signals are therefore internally consistent - high technical impact but constrained, manual, local exploitation - pointing to a patch-in-normal-cycle item rather than a drop-everything priority. Note one metadata conflict: the input Tags label this 'Information Disclosure,' which contradicts both the description ('elevate privileges locally') and the CVSS impact profile (I:H/A:H, not confidentiality-only); treat this as a local EoP, not an info-disclosure bug.

An attacker who has already gained low-privileged code execution on a Windows host (e.g., via a standard user account or a compromised low-integrity process) plants or manipulates a symbolic/hard link that the WalletService resolves before accessing a file. By winning the link-resolution race, the attacker redirects a privileged file operation to a target of their choosing, enabling arbitrary file write/overwrite as SYSTEM and full privilege escalation. No public exploit code was identified at the time of analysis, and exploitation requires local access plus the ability to influence filesystem links.