Windows Search EUVD-2026-56313

Exploitation requires a valid low-privileged local account on the target Windows system, as confirmed by the CVSS PR:L metric and the description's reference to 'an authorized attacker.' The attack is strictly local (AV:L) - remote exploitation without a prior foothold is not possible. No user interaction from any victim is required (UI:N), and attack complexity is low (AC:L), meaning no race conditions or special environment timing are needed beyond having an active local session. The Windows Search service must be running, which is the default configuration on all affected Windows editions. Exploitation is bounded by the requirement for local access: a purely remote, unauthenticated attacker cannot leverage this vulnerability without first compromising a local account through another vector.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) scores 5.5 Medium, reflecting a locally-constrained flaw with high confidentiality impact but no integrity or availability consequence. The low attack complexity and absence of required user interaction indicate that a local attacker with any valid account can exploit this reliably without special environment conditions. The critical limiting signal is AV:L - exploitation requires existing local access, meaning a purely remote or unauthenticated attacker cannot leverage this directly. No EPSS score was provided in the source intelligence, so exploitation probability cannot be quantified from available data. The vulnerability is not listed in CISA KEV and no proof-of-concept code is referenced, confirming no public exploit identified at time of analysis. Real-world priority is moderate: highest in multi-user Windows environments (terminal servers, VDI, shared workstations) where the Search index may contain cross-user sensitive data; lower in single-user or tightly controlled endpoints where local access is already strongly restricted. The mismatch between the description's phrase 'authorized attacker' and a true exploitation scenario is worth noting - this implies the threat actor already holds a legitimate account, limiting opportunistic attack surface.

A low-privileged user on a shared Windows terminal server or multi-user endpoint abuses the weak authentication in the Windows Search Component to query the search index and retrieve file names, content snippets, or metadata from documents belonging to other users or restricted system paths - for example, recovering cached credentials, sensitive HR files, or configuration data indexed from administrative shares. Because attack complexity is low and no user interaction is required, the attacker executes this from any local command prompt or scripted call once a valid account is obtained. No public proof-of-concept code has been identified at time of analysis.