Windows Search EUVD-2026-43908

Exploitation requires the attacker to already hold valid local, low-privileged access to the target Windows machine (CVSS PR:L, AV:L), and the Windows Search component must be present and running - which it is by default on all listed client and server SKUs. The limiting factors are that the attack is strictly local (no network vector), so the attacker needs a prior foothold such as a standard user account, an interactive/RDP session, or code execution as a limited user; there is no user interaction requirement (UI:N) to ease exploitation, but the absence of any network path and the need for pre-existing authenticated access substantially narrow realistic risk to multi-user and already-compromised hosts.

The CVSS 3.1 vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (7.8, High) describes a local attack requiring only low existing privileges, low complexity, and no user interaction, yielding full confidentiality, integrity, and availability impact within the same scope - a classic reliable local EoP profile. No EPSS score was supplied, and the vulnerability is not in CISA KEV, so there is no evidence of active or widespread exploitation; likewise no POC was provided, so real-world risk is currently theoretical. This is a genuine priority for multi-user, terminal-server, and workstation-hardening contexts where limiting non-admin users to their assigned privilege level matters, but it is not an internet-facing or wormable issue because it requires the attacker to already have a foothold on the host. No SSVC decision data was provided; the assessment here rests entirely on the CVSS vector and Microsoft's own reporting.

An attacker who has already obtained a standard, non-administrative account on a Windows host - for example through phishing, a stolen credential, or a shared terminal server - invokes the vulnerable Windows Search functionality to abuse its improper access-control check and execute code or actions in the security context of the elevated service, obtaining SYSTEM-level privileges. Given AC:L and UI:N, the technique is low-complexity and needs no victim interaction once the attacker has local access; no public POC was provided in the source data.