Windows Performance Monitor EUVD-2026-35736

No authentication is required (PR:N) and no user interaction is needed (UI:N), but the attacker must have network reachability to the Windows Performance Monitor RPC/named-pipe interface on the target - typically TCP/445 (SMB-over-named-pipe) or the RPC endpoint mapper on TCP/135 plus a dynamic high port. Exploitation is further gated by AC:H, meaning the attacker must satisfy non-trivial conditions outside their direct control such as winning a race, achieving a specific heap layout, or sending a precisely sized sequence of inputs to trigger the integer underflow reliably. Hosts where SMB and RPC are blocked from untrusted networks, or where Performance Monitor remote collection services are disabled, are not realistically reachable for this vector.

The CVSS vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H signals network-reachable, unauthenticated RCE with full CIA impact - a textbook high-priority profile - but AC:H indicates the attacker must win a race condition, satisfy specific memory layout requirements, or chain values to trigger the underflow reliably, which materially reduces opportunistic mass exploitation. There is no CISA KEV listing and no public POC identified at time of analysis, and EPSS data is not provided in the input, so realistic short-term exploitation pressure appears limited. However, because the affected component (Performance Monitor / perfmon RPC interfaces) is widely deployed across Windows endpoints and servers and the impact is full code execution, this should be patched on internet-exposed or untrusted-network-adjacent Windows hosts with priority. Note: the description states 'unauthorized attacker' but the precise pre-auth network surface (which RPC interface, which transport, whether SMB/named pipe gating applies) is not detailed in the available data - verify with Microsoft's MSRC guide before assuming exposure on hardened deployments.

An attacker on the same network segment as a vulnerable Windows host sends a crafted RPC request to the Performance Monitor interface containing a maliciously chosen length or counter field that triggers the integer underflow during input processing. The wrapped value drives an out-of-bounds memory write that overwrites a function pointer or return address, yielding arbitrary code execution in the context of the PerfMon service. AC:H means the attacker likely needs multiple attempts or heap-grooming preparation to reliably land the exploit, so this is more plausible as a targeted post-foothold lateral movement primitive than a worming mass-exploit.