Windows Media Foundation EUVD-2026-100355

Requires the attacker to already have local, authenticated low-privileged code execution on the target Windows system (CVSS PR:L, AV:L) - this is a local escalation primitive, not remotely reachable. Exploitation involves triggering the use-after-free within Windows Media Foundation, which typically means causing the system or the attacker's process to invoke Media Foundation parsing/playback or its APIs; no user interaction is required (UI:N) and attack complexity is low (AC:L). Limiting factors: there is no remote network vector, the attacker needs a pre-existing foothold with the ability to run code, and exploitation is confined to the local host (scope unchanged, S:U).

This is a locally-exploitable privilege-escalation flaw (CVSS 3.1 7.8, High) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The vector confirms the attacker must already have local, low-privileged code execution (PR:L) on the target - this is not a remote entry point but a second-stage escalation primitive. Attack complexity is low and no user interaction is required, so once a foothold exists, reliable exploitation is plausible. However, several high-value triage signals are MISSING from the input: no EPSS exploitation-probability score is provided, the vulnerability is NOT listed in CISA KEV, and no public proof-of-concept is referenced (the only reference is the Microsoft MSRC update-guide page). Therefore there is no confirmed active exploitation and no evidence of a public exploit at time of analysis. Priority should be driven by the product's ubiquity (Windows Media Foundation ships in every Windows install) and its classic role in post-compromise SYSTEM escalation chains, rather than by any confirmed exploitation signal. Note a minor data inconsistency: the input Tags include 'Denial Of Service,' but the description and the C:H/I:H/A:H impact describe privilege elevation, not a DoS - treat the DoS tag with caution.

An attacker who has already obtained low-privileged code execution on a Windows host (e.g., via phishing or an initial-access exploit) invokes Windows Media Foundation in a way that triggers the use-after-free in CWE-416, corrupting memory to run attacker-controlled code at a higher privilege level and obtain SYSTEM. No public exploit code is identified at time of analysis, and the low attack complexity (AC:L) with no required user interaction makes reliable exploitation feasible once a foothold exists.