Windows UxTheme EUVD-2026-35685

Exploitation requires a locally authenticated session with at minimum low-level user privileges, consistent with the CVSS vector AV:L/PR:L. The attacker must have interactive or programmatic access to the target system - remote network-only access is insufficient. No user interaction from a second party is required (UI:N), meaning the exploit is self-contained once the attacker has a local session. The vulnerability is limited to systems running an unpatched build of uxtheme.dll on the affected Windows versions; systems that have received the relevant Microsoft security update are not vulnerable. No specific non-default configuration, feature flag, or application is identified in available data as a prerequisite trigger - the exposure appears to exist in the general theme library present on all affected Windows installations.

The CVSS 5.5 Medium score reflects a local-only attack vector (AV:L) requiring low-level privileges (PR:L), with no user interaction needed (UI:N) and impact scoped entirely to availability (A:H). Real-world risk is moderate-to-low: exploitation requires an authenticated local session, severely limiting the attacker population to those who have already gained a foothold on the target system. For standalone workstations this is a minor concern; for multi-tenant environments, shared terminal servers, or VDI infrastructure, a local denial-of-service primitive becomes more significant as it could be abused to disrupt service for other users. No EPSS score was provided in the source data, so exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog, and no public proof-of-concept code has been identified, further depressing near-term exploitation likelihood. The tag data mentions 'Information Disclosure', which conflicts with the CVSS C:N score - this discrepancy should be verified against the Microsoft MSRC advisory; if a confidentiality impact exists, the risk posture would require reassessment. Overall, this is a real but lower-priority patch item absent evidence of active exploitation.

A low-privileged local user - or an attacker who has already compromised a standard user account via phishing or credential theft - executes a crafted application or triggers a theme-rendering operation that causes uxtheme.dll to perform an out-of-bounds read, resulting in an access violation that crashes the Windows session or system process. This vector is particularly relevant on shared multi-user systems such as Remote Desktop Services hosts, where a single low-privilege user can deny service to all other active sessions. No public proof-of-concept code has been identified at time of analysis.