Windows WebDAV EUVD-2026-100233

Exploitation requires the attacker to already have a low-privileged authenticated local session on the Windows host (CVSS PR:L, AV:L) and the ability to reach the vulnerable WebDAV handling code - practically meaning the WebDAV/WebClient functionality must be present and reachable on the target. There is no network vector and no user interaction is needed (UI:N). Limiting factors that reduce real-world risk: the attacker needs a pre-existing foothold with code execution as a normal user, so this cannot be used as an initial remote entry point; SSVC marks it non-automatable, indicating it is not suited to mass/wormable exploitation. Risk is highest on multi-user systems (terminal/RDS servers, shared workstations) where untrusted users can execute code.

This is a genuinely actionable local privilege-escalation flaw but not a drop-everything emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U) describes a low-complexity local attack requiring an attacker to already hold low-privilege authenticated access on the Windows host; it is not remotely exploitable despite the 7.8 'High' base score, and the score is driven entirely by the total impact (C:H/I:H/A:H) typical of SYSTEM-level escalation. The signals are internally consistent and point to LOWER real-world urgency than the raw score suggests: SSVC reports Exploitation=none (no observed exploitation), Automatable=no (it is not mass-scannable/wormable because it needs a local foothold), and the CVE is NOT in CISA KEV. No POC is referenced and no EPSS score is provided in the input, so exploitation probability cannot be quantified here - this is a data gap, not evidence of safety. The realistic role of this bug is as a second-stage local escalation primitive chained after an initial foothold (phishing, another RCE, or an insider), rather than an internet-facing entry point. Prioritize it in normal Patch Tuesday cadence, weighted up for multi-user, terminal-server, and shared workstation environments where untrusted low-privilege users run code.

An attacker who has already gained a low-privileged authenticated session on a Windows machine (e.g. via phishing, stolen credentials, or a prior exploit) runs a crafted program that drives the vulnerable WebDAV code path to overflow a heap buffer. Successful exploitation corrupts heap memory to achieve code execution as SYSTEM, completing a local privilege escalation. No public exploit code is identified at time of analysis, and the attack requires local access rather than a network connection.