Windows Push Notifications EUVD-2026-43853

Exploitation requires the attacker to already have local, authenticated access to the target host at a low privilege level (CVSS PR:L) and the ability to execute code that interacts with the Windows Push Notification service; no user interaction is needed (UI:N) and the attack is local only (AV:L), so it cannot be launched remotely over the network. The limiting factors that reduce realistic risk are the need for a pre-existing foothold and low-privileged code execution on the machine - this is a privilege-escalation primitive, not an initial-access vector. It affects default Windows installations across the listed client and server builds (the push notification service is present by default), so no unusual non-default configuration is required beyond having the affected, unpatched OS build.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8 High) describes a reliable local elevation: an attacker needs low privileges and local access but no user interaction, and complexity is low. This is a strong signal for real-world abuse as a post-compromise step, since EoP bugs are staple components of exploit chains and malware. Countervailing signals lower immediate urgency: it is not in CISA KEV, no EPSS score was provided in the input, and no public POC or exploit code was identified, so there is currently no evidence of active or widespread exploitation. Because the vector is local (AV:L), this is not remotely wormable and does not expose an internet-facing attack surface; its value to an attacker is escalation after an initial foothold. No conflicting data was found - the description (local elevation) and the CVSS vector (AV:L, PR:L) are consistent. Treat as a standard Patch-Tuesday-class EoP: prioritize on endpoints where untrusted code or users already run, but it is not a drop-everything remote-exploitation emergency.

An attacker who already has a low-privileged foothold on a Windows host - for example via phishing, a compromised standard user account, or a low-integrity application - sends crafted notification data to the Windows Push Notifications service to trigger the heap overflow, corrupting memory in the higher-privileged service and elevating to SYSTEM. Given AV:L/AC:L, exploitation is local and low-complexity, making it an attractive second-stage escalation primitive; no public exploit code has been identified at time of analysis.