Windows Storage EUVD-2026-35515

Attacker must already possess valid local low-privilege credentials on the target Windows host (PR:L) and the ability to write files to a directory that the vulnerable Windows Storage code path searches - this is what CWE-426 'untrusted search path' means in practice. Exploitation is limited by the AC:H rating, indicating success depends on conditions outside the attacker's direct control such as a race window, a specific storage operation being triggered by another user or scheduled task, or particular filesystem layout; no user interaction is required once those conditions are met (UI:N). Remote network exploitation is not possible (AV:L).

The CVSS 3.1 vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H scores 7.0 (High) but contains two notable dampeners: local-only attack vector and high attack complexity, indicating the attacker must already have a foothold and must satisfy non-trivial conditions (likely a race window or specific filesystem state) to win. No EPSS value was supplied in the input, no POC has been identified, and the CVE is not on CISA KEV, so this is best treated as a post-compromise privilege-escalation primitive rather than an internet-facing emergency. The Microsoft 'Information Disclosure' tag in the input is inconsistent with the C:H/I:H/A:H impact metrics describing full compromise - this tagging conflict should be verified directly against the MSRC advisory before relying on it for triage.

A standard domain user logs into a workstation, drops a malicious DLL (or other resource) into a directory that the vulnerable Windows Storage process searches before the trusted system path, then triggers the storage operation that causes the elevated process to load the planted binary, granting the attacker SYSTEM-level code execution. The high attack complexity (AC:H) implies the attacker may need to win a timing race or stage a particular filesystem condition, so the exploit is plausible against an already-compromised host but unlikely to be a first-stage payload.