Windows UEFI EUVD-2026-35696

Exploitation requires local code execution on the target Windows host as an authenticated user with low privileges (CVSS PR:L), with no user interaction needed (UI:N) and no network reachability (AV:L), meaning the attacker must already be on the system via prior compromise, malicious insider access, or physical/console access. Limiting factors include the requirement for a valid local logon session on a Windows build that ships the vulnerable UEFI component, and the bypass targets a specific (unnamed in the provided description) Windows UEFI security feature - systems where that feature is not enabled or not relied upon for the defender's threat model gain little additional risk, while systems depending on UEFI-backed boot integrity (Secure Boot, VBS, BitLocker measured boot) are the meaningful targets.

The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H yields a base score of 7.8 and characterizes this as a local attack requiring low privileges and no user interaction, with high impact across CIA - consistent with a privileged-user-to-firmware-trust bypass rather than a remote compromise. No EPSS score, KEV listing, SSVC decision, or POC indicator was supplied, so probabilistic exploitation likelihood cannot be quantified from the provided data; however, the local-only attack vector and required prior code execution as an authenticated user materially lower real-world risk versus a network-reachable RCE of the same score. The signals are not in conflict but are sparse: a single Microsoft advisory reference is provided, and the description's terse 'bypass a security feature' wording does not name which protection (e.g., Secure Boot, HVCI, VBS) is defeated, which limits ability to prioritize against specific threat models - verify with the MSRC advisory before treating this as a boot-chain compromise versus a lower-tier feature bypass.

An attacker who has already obtained a standard authenticated local session on a Windows endpoint - for example via phishing-delivered malware or stolen credentials - executes a crafted tool that interacts with the vulnerable UEFI security mechanism to disable or bypass it, then leverages that bypass to tamper with boot components, escalate trust, or persist across reboots. No public exploit identified at time of analysis, and the local-only AV:L vector means this would typically be chained after an initial foothold rather than used for initial access.