Microsoft Sysinternals EUVD-2026-100317

Exploitation requires the attacker to already hold local, low-privileged authenticated access to a Windows system on which a vulnerable Microsoft Sysinternals utility is present and executed in a higher-privilege context (CVSS PR:L, AV:L, UI:N, S:U). The limiting factors are significant: there is no remote attack surface, the attacker needs an existing foothold, and impact is confined to the local host (scope unchanged). Availability is not affected (A:N); confidentiality and integrity are (C:H/I:H). The exact vulnerable tool, version, and triggering operation are not specified in the available data.

This is a moderate-severity local privilege escalation (CVSS 7.1, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) in Microsoft Sysinternals arising from an untrusted pointer dereference (CWE-822). The CVSS vector confirms the attacker must already have local, low-privilege authenticated access (AV:L, PR:L), which substantially limits real-world risk - this is not a remote or unauthenticated flaw and cannot be the initial entry point into an environment. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of active exploitation or weaponization. Note a conflict in the metadata: the single Tag is 'Information Disclosure', yet the description explicitly states privilege elevation and the CVSS records both C:H and I:H - treat this as a local EoP affecting confidentiality and integrity rather than pure information disclosure. Overall this is a credible but second-stage (post-compromise) issue: a real patch priority for hardened/multi-user Windows admin hosts, but lower urgency than any network-exploitable or KEV-listed vulnerability.

An attacker who has already obtained a low-privileged foothold on a Windows host where a vulnerable Sysinternals tool runs with higher privileges triggers the untrusted pointer dereference to corrupt execution flow and gain elevated privileges. Because the CVSS vector is AV:L/PR:L/UI:N, no user interaction or remote access is needed - only prior local authenticated access. No public exploit code is identified in the available data.