Microsoft Windows EUVD-2026-31006

Physical access to the target Windows device is the mandatory prerequisite - the CVSS AV:P vector explicitly rules out remote or adjacent-network exploitation. Once physical presence is established, no authentication or prior privileges are required (PR:N), and no victim interaction is needed (UI:N), making the attack entirely attacker-driven. The specific Windows component, interface, or configuration state that must be reachable for injection (e.g., recovery console, pre-boot diagnostics, locked screen shell) is not named in available data and should be confirmed via the MSRC advisory. The primary limiting factor is physical proximity - this vulnerability cannot be exploited over a network, over Bluetooth, or remotely in any confirmed form based on the AV:P vector. Attack complexity is low (AC:L) once access is achieved, meaning no race conditions, special timing, or environmental prerequisites are required beyond physical presence.

CVSS 6.8 (Medium) reflects the physical access prerequisite dragging down an otherwise total-impact vulnerability. The C:H/I:H/A:H triad across an unchanged scope means successful exploitation yields full device compromise, but AV:P is the dominant risk-limiting signal - remote exploitation is ruled out by the vector. EPSS data is not available in the provided intelligence, so exploitation probability cannot be quantified by that framework. KEV status: not listed in CISA KEV at time of analysis, meaning confirmed widespread active exploitation has not been formally reported. However, a public POC exists per Microsoft's own advisory, which is a meaningful escalation - any attacker with physical access can now reproduce the attack without deep expertise. SSVC signals: exploitation possible (POC public), automatable at scale is unlikely (physical vector), technical impact is total. Real-world priority is high for organizations managing high-value physical assets - executive laptops, government endpoints, kiosks, shared terminals, border-crossing or customs devices - and substantially lower for organizations with strong physical access controls and no shared-device risk. The gap between CVSS 6.8 and the C:H/I:H/A:H impact ratings warrants attention: do not dismiss this as medium risk for physically exposed deployments.

An adversary with brief physical access to a target Windows device - such as an unattended laptop at a conference, a shared workstation in a semi-public office, or a kiosk in a retail or government facility - accesses an exposed pre-boot or locked-state interface and injects commands using the publicly available 'YellowKey' POC. With no authentication required and low attack complexity, the injected commands bypass the Windows security feature protecting that interface, granting the attacker full control of the device including access to encrypted volumes, credential stores, or the ability to install persistent implants before the legitimate user returns.