Windows Push Notifications EUVD-2026-35741

Attacker must already have authenticated local code execution as a low-privileged user (PR:L) on the target Windows host - this is not remotely exploitable. The attacker must specifically interact with the Windows Push Notifications service (WpnUserService/WpnService), which is enabled by default on Windows client editions, and must reliably win a timing race window between concurrent threads - the CVSS High attack complexity (AC:H) reflects that this race is not trivially won and may require many attempts or specific hardware/scheduling conditions. No user interaction is required (UI:N). Hosts that have the Push Notifications service disabled, or that do not permit untrusted users to execute arbitrary code locally, are not realistically exploitable.

Real-world risk is moderate rather than critical despite the 7.8 CVSS base score. The vector AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H confirms local access with low privileges is required, attack complexity is High (meaning the race condition window is non-trivial to win reliably), and no user interaction is needed. The High attack complexity is significant - race conditions often require many attempts, precise timing, or specific hardware configurations to land. EPSS data was not provided in the input, and the CVE is not listed in CISA KEV, indicating no confirmed active exploitation. No public POC is referenced. The Information Disclosure tag in the metadata is slightly inconsistent with the description's framing as an elevation of privilege - verify with the Microsoft advisory which impact dominates. Priority should be standard Patch-Tuesday cadence for endpoints where untrusted local users may execute code, elevated for multi-tenant or shared workstations.

An attacker with valid low-privilege credentials on a Windows host - for example a standard domain user on a shared workstation, a compromised service account, or a foothold gained through phishing - runs a small tool that repeatedly invokes Push Notifications APIs while a second thread manipulates the shared resource to win the race window. On a successful run, the attacker's code executes in the security context of the higher-privileged notification service, allowing them to access protected resources or stage further lateral movement. The High attack complexity means the attacker may need to retry many times or run on specific CPU configurations.