Microsoft Windows EUVD-2026-43875

Exploitation requires the attacker to already possess local, authenticated access with low privileges (CVSS PR:L) and the ability to run code that reaches the Windows Application Model component - i.e. the standard packaged-app activation/lifecycle brokering path present by default on all supported Windows builds. No user interaction and no special or non-default configuration is needed (UI:N, AC:L), so any interactive or remote-desktop user on an unpatched host meets the bar. The principal limiting factor is that the attack vector is local only (AV:L): it cannot be triggered remotely over the network and presupposes an existing foothold, making this a post-compromise escalation rather than an initial-access vector, with shared multi-user and session-host systems being the highest-risk deployments.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8, High) describes a locally-exploitable, low-complexity flaw requiring only low existing privileges and no user interaction, with full confidentiality, integrity and availability impact - a classic reliable local EoP profile. There is no EPSS score, no KEV listing, and no POC in the provided data, so real-world exploitation is currently unproven; EPSS for freshly disclosed Microsoft EoP bugs is typically low because they require prior code execution rather than remote reach. Practically this is a second-stage/post-compromise escalation primitive: not an internet-facing emergency, but valuable to any attacker or malware that already has a user-context foothold, and use-after-free EoPs in core Windows components historically do get weaponized after patch analysis. Prioritize in the standard Patch Tuesday cycle; escalate if a POC emerges or if it is later added to KEV. Missing signal to note explicitly: no EPSS or SSVC data was provided, so exploitation likelihood is inferred from the CVSS vector and CWE class, not measured.

An attacker who has already gained low-privileged code execution on a Windows host - for example via a phishing payload running in a standard user context or an untrusted user on a shared RDP session host - invokes the vulnerable Windows Application Model code path to trigger the use-after-free, grooms the heap to control the freed object, and elevates to SYSTEM to disable security tooling and install persistence. No user interaction is required and attack complexity is low, making exploitation reliable once a working technique exists, though no public POC is identified at time of analysis.