Windows RPC Runtime EUVD-2026-100334

Exploitation targets the Windows RPC Runtime and requires user interaction (CVSS UI:R): the victim must initiate or accept an RPC connection to an attacker-controlled endpoint, which then returns crafted data that triggers the untrusted pointer dereference (CWE-822). No prior authentication is needed on the target (PR:N), but the mandatory user interaction is the primary limiting factor - this is not a drive-by, self-propagating remote exploit, consistent with SSVC Automatable=no. All supported Windows client and server editions below the fixed build numbers in EUVD-2026-100334 are in scope; patched builds are not exploitable.

This is a genuinely high-severity issue but with a nuanced real-world urgency profile. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.8) indicates a network-reachable, low-complexity, unauthenticated code-execution flaw in the Windows RPC Runtime - a core, ubiquitous component - with full confidentiality, integrity, and availability impact. However, the single most important mitigating signal is UI:R: exploitation requires user interaction, consistent with a client-side pattern (victim induced to connect to a malicious RPC endpoint) rather than fully autonomous remote exploitation. CISA's SSVC framework reinforces a lower immediate priority: Exploitation=none (no observed exploitation), Automatable=no (consistent with the UI:R requirement preventing worm-like spraying), yet Technical Impact=total (matching the C:H/I:H/A:H RCE outcome). There is no CISA KEV listing and no public exploit identified, so active-exploitation signals are absent. CWE-822 (untrusted pointer dereference) aligns with code execution and contradicts the single input tag 'Authentication Bypass' - that tag appears mislabeled and should not drive triage. Net: treat as a high-priority patch for a universally deployed component, but the UI requirement and absence of exploitation/automation evidence place it below drive-by, wormable RPC flaws (e.g. unauthenticated server-side RPC RCE with UI:N).

An attacker stands up a malicious RPC server (or a resource that triggers an outbound RPC connection) and lures a Windows user into connecting to it - for example via a crafted link, document, or network share. The malicious endpoint returns data that triggers an untrusted pointer dereference in the RPC Runtime, allowing the attacker to execute code on the victim's machine. No public exploit identified at time of analysis, and user interaction is required, which raises the bar versus a fully automated remote attack.