What is the CVSS score of EUVD-2026-35585?

EUVD-2026-35585 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Windows Narrator are affected by EUVD-2026-35585?

Windows Narrator Braille accessibility component (CVE-2026-48565, CVSS 7.8) permits authenticated low-privilege users to execute code with elevated system permissions on affected endpoints.

How to fix or mitigate EUVD-2026-35585?

24 hours: Audit systems with Narrator Braille enabled and identify low-privilege user populations; disable Narrator Braille component on machines where accessibility requirements do not mandate its use. 7 days: Apply Windows latest cumulative updates to ensure baseline integrity; restrict and monitor low-privilege account capabilities; enable and review Windows Event Viewer logs for privilege escalation attempts (Event IDs 4688, 4673). 30 days: Establish continuous monitoring for Microsoft security advisories; pre-stage deployment procedures for vendor-released patch when available; evaluate endpoint detection and response (EDR) solution deployments on affected systems.

Windows Narrator EUVD-2026-35585

| CVE-2026-48565 HIGH

Untrusted Search Path (CWE-426)

2026-06-09 secure@microsoft.com

GHSA-x9hc-8r9x-c29v

Information Disclosure Microsoft Windows Narrator Braille

7.8

CVSS 3.1 · NVD

Temporal: 6.8

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CIRCL (temporal)

6.8 MEDIUM

cvss

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 17:50 vuln.today

CVE Published

Jun 09, 2026 - 17:17 nvd

HIGH 7.8

DescriptionNVD

Untrusted search path in Windows Narrator Braille allows an authorized attacker to elevate privileges locally.

AnalysisAI

Local privilege escalation in Windows Narrator Braille component allows an authenticated low-privileged user to gain elevated privileges by exploiting an untrusted search path (CWE-426). The flaw affects the accessibility subsystem on Windows and was reported directly by Microsoft (secure@microsoft.com); no public exploit identified at time of analysis. With CVSS 7.8 and full CIA impact on the local host, successful exploitation grants the attacker code execution at a higher privilege context than they started with.

Technical ContextAI

The vulnerability resides in the Braille support code path within Windows Narrator, the built-in screen reader accessibility service. CWE-426 (Untrusted Search Path) indicates that the affected binary or component resolves a dependency - typically a DLL, helper executable, or configuration resource - by traversing a search path that includes a directory writable by lower-privileged users. When the Narrator Braille service or one of its loaders runs in an elevated security context and references that path, it loads attacker-controlled content. This pattern is commonly exploited as a 'DLL search-order hijack' or 'binary planting' issue, and it is recurrent in Windows accessibility components which historically run with elevated tokens to support secure desktop interactions.

RemediationAI

Patch availability cannot be independently confirmed from the supplied data; consult the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-48565 for the specific KB article and apply the corresponding monthly cumulative security update through Windows Update or WSUS. Until the patch is deployed, compensating controls include disabling Narrator on systems where assistive technology is not required (Settings → Accessibility → Narrator → Off; side effect: removes screen reader access for users who depend on it), restricting interactive logon to trusted users via Group Policy on shared and kiosk systems, and auditing world-writable directories on the default PATH for unexpected DLLs or executables that match Narrator's load behavior. Application allow-listing tools such as Windows Defender Application Control or AppLocker configured in enforcement mode will block the planted binary from executing, with the trade-off of requiring an inventory of legitimately needed binaries.