Microsoft Windows EUVD-2026-29600

Exploitation requires the attacker to already be authenticated on the target as a low-privileged local user (PR:L) with the ability to execute code locally (AV:L); it is not remotely reachable and requires no victim user interaction (UI:N). The vulnerable path is in the Windows LLDP component, so the affected system must have the LLDP driver active (default on Windows network adapters). Exploitation is limited by high attack complexity (AC:H) - a double-free/heap race that is not reliably repeatable and requires precise heap grooming - which is why SSVC marks it Automatable: no and EPSS is 0.04%. The impact is confined to the vulnerable system itself (S:U, no scope change to other systems).

The signals converge on a genuine but non-emergency local EoP. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0) requires local access, existing low privileges, and - notably - high attack complexity, meaning reliable exploitation likely depends on winning a race or grooming the heap. EPSS is very low (0.04%), SSVC reports Exploitation: none and Automatable: no, and there is no KEV listing, all reinforcing that widespread or automated exploitation is unlikely. Countervailing that, SSVC rates Technical Impact as 'total' and CVSS impact is full C/I/A High, so a successful exploit yields complete system compromise. Net: this is a real patch-worthy issue for privilege-boundary hardening, not a drop-everything internet-facing threat. Note a minor data inconsistency - the input Tags label this 'Information Disclosure', but the description and CVSS (I:H/A:H) describe privilege elevation via memory corruption; treat the memory-corruption/EoP characterization as authoritative and the tag as likely mislabeled.

An attacker who already has an ordinary user account or code execution on a Windows host (for example via a phished standard user or a compromised low-privilege service) runs a local tool that repeatedly triggers the vulnerable LLDP code path to force a double free, then grooms the heap to reclaim the freed allocation and hijack execution flow, elevating to SYSTEM. The high attack complexity (AC:H) means the exploit likely relies on a timing race and may require several attempts to succeed; no public proof-of-concept has been identified at time of analysis.