PCI Bus Driver EUVD-2026-100246

Exploitation requires the attacker to already hold a valid low-privilege local session on the target Windows host (CVSS PR:L, AV:L) - there is no remote or network path and no user interaction is needed (UI:N). The attacker must be able to execute code locally to invoke the PCI Bus Driver and send the malformed input that triggers the heap overflow; the driver is a default, always-present kernel component on all supported Windows client and server editions, so no special feature or non-default configuration is needed beyond local access. Limiting factors: the need for an existing local foothold, and that SSVC rates the attack as not automatable, reducing mass-exploitation likelihood.

This is a credible but non-urgent prioritization. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, base 8.8) describes a low-complexity local privilege escalation requiring only low pre-existing privileges, with a scope change and total loss of confidentiality, integrity, and availability - consistent with a kernel-mode PCI Bus Driver flaw that yields SYSTEM. However, the exploitation signals temper the raw score: CISA's SSVC decision data lists Exploitation as 'none' and Automatable as 'no' (Technical Impact 'total'), there is no CISA KEV listing, no EPSS value was supplied, and no public exploit identified at time of analysis. The signals are therefore internally consistent rather than conflicting: high technical impact but currently no evidence of exploitation and not automatable, which points to a patch-on-normal-cycle priority rather than an emergency. The main risk driver is ubiquity of Windows plus the SYSTEM-level outcome, meaning it is attractive as a post-compromise/local-escalation link in a chain. Note that EPSS is missing, so widespread-exploitation probability cannot be quantified from the input.

An attacker who already has a low-privileged foothold on a Windows host (e.g. a standard user account gained via phishing or a prior exploit) runs a crafted program that issues malformed input to the PCI Bus Driver, triggering a heap-based buffer overflow in kernel memory. By controlling the corrupted heap data they escalate to SYSTEM, taking full control of the machine. No public exploit code has been identified at time of analysis, and the local-only, low-complexity vector means this is a realistic second-stage escalation rather than an initial-access vector.