Windows wininet.dll EUVD-2026-35550

Attacker must already have local interactive or remote-shell access to the Windows host as a low-privileged user (CVSS PR:L), meaning this is a post-compromise privilege escalation rather than a remote entry vector; no user interaction by another principal is required (UI:N). The attacker must be able to invoke or influence a code path in wininet.dll - either directly by executing code that calls the WinINet API, or indirectly by feeding crafted data to a higher-privileged process that uses WinINet for HTTP/FTP operations. Limiting factors: the attack vector is local (AV:L), so the bug is not reachable directly from the network; the attacker needs an existing foothold, and the specific feature path that triggers the integer overflow is not disclosed in the CVE description, meaning exploit development requires reverse engineering of the patched wininet.dll diff.

The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H describes a local attack requiring low privileges, no user interaction, and yielding high impact across confidentiality, integrity, and availability - consistent with a classic local privilege escalation primitive. This is not in CISA KEV and no EPSS score was provided in the input, so widespread exploitation cannot be asserted; however, wininet.dll is an extremely high-value target given its ubiquity across Windows endpoints, and historically Microsoft EoP bugs in core networking libraries have been adopted by ransomware and APT operators as a second-stage chaining primitive after initial code execution. The score is realistic rather than inflated: an attacker must already have a foothold on the host, which lowers acute risk versus a pre-auth RCE, but the AC:L (low complexity) and PR:L (only low privileges needed) make it attractive once initial access exists. Note that no EPSS, KEV, POC, or SSVC data was provided - the assessment relies entirely on the CVSS vector, CWE, and reporter identity.

An attacker who has already obtained low-privileged code execution on a Windows host - for example via a phishing payload, a browser exploit, or a compromised standard user account - invokes a wininet.dll code path with crafted inputs that trigger the integer overflow during a length or size calculation. The resulting buffer overflow corrupts heap or stack memory in a process running at higher privilege (or is leveraged via a token-stealing primitive), yielding SYSTEM-level execution and full host takeover. No public exploit identified at time of analysis, so a working primitive would need to be developed or sourced privately.