Windows Collaborative Translation Framework EUVD-2026-35548

The attacker must already have an authenticated interactive local session on the target Windows host (CVSS PR:L, AV:L) and the ability to create symbolic links, junctions, or hard links in a filesystem location that the Collaborative Translation Framework component touches with elevated privilege; no victim user interaction is required (UI:N). Exploitation is limited to machines where the affected CTF code path is reachable and where the local account either possesses SeCreateSymbolicLinkPrivilege or can use junctions/hard links (which do not require that privilege), so heavily locked-down kiosks and servers without local interactive logons present a substantially smaller attack surface than multi-user workstations and RDS/Citrix hosts.

The CVSS vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H describes a low-complexity local attack by an already-authenticated low-privileged user with full CIA impact, which is consistent with classic Windows EoP primitives via symlink abuse. There is no EPSS score, KEV listing, or public POC referenced in the provided intelligence, so real-world exploitation pressure appears low at this moment, but link-following EoPs in Windows components historically gain public POCs quickly once researchers reverse the patch. Note one inconsistency: the supplied tags list 'Information Disclosure', while the CWE, description, and CVSS all describe privilege elevation - treat the tags as mislabeled and rely on the CWE/CVSS/description, which are mutually consistent. Priority should be standard Patch-Tuesday cadence for workstations and elevated cadence for multi-user/RDS hosts where untrusted local users exist.

An attacker who has already obtained a low-privileged interactive shell on a Windows host - for example via phishing-delivered malware or a compromised standard-user RDP account - plants a symbolic link or junction in a directory that the privileged Collaborative Translation Framework service later operates on. When the privileged process follows the link, it writes to or alters ACLs on an attacker-chosen system file, which the attacker then leverages to execute code as SYSTEM. No user interaction is required beyond the attacker's own session.