Windows Remote Access EUVD-2026-56435

Exploitation requires an authenticated local user account on the target Windows system (PR:L per CVSS vector); a standard, non-administrative account is sufficient. The attacker must be able to invoke Windows Remote Access API functions, which are accessible to standard user-mode processes on all affected Windows versions regardless of whether VPN or dial-up features are actively in use. Remote exploitation over the network is not possible - physical or logical local access (interactive logon, RDP session, or similar) is mandatory (AV:L). No privileged user interaction is required (UI:N), meaning exploitation is entirely attacker-driven once local access exists. Systems where standard user accounts are prevented from logging on locally or via RDP - through Group Policy User Rights Assignment - are at substantially reduced risk, as obtaining the required PR:L foothold becomes the binding constraint.

The CVSS 3.1 base score of 7.8 (High) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H accurately captures the severity profile: low exploitation complexity, no user interaction, and complete C/I/A compromise make this a reliable LPE primitive. The critical limiting factor is the local attack vector (AV:L) - exploitation requires an attacker who already holds an authenticated foothold on the target system, positioning this as a second-stage escalation tool rather than a remote initial access vector. CVE-2026-65671 is not listed in CISA KEV, confirming no active widespread exploitation is known at time of analysis, and no POC has been identified. No EPSS score was provided, so exploitation probability is inferred from CVSS metrics alone. Real-world risk is materially elevated on multi-user or RDP-exposed systems - servers, VDI environments, shared developer workstations - where low-privileged accounts are routine and local access is easily obtained after an initial compromise. The breadth of affected Windows versions (seventeen distinct product/version combinations from Server 2012 R2 through Windows 11 26H1) substantially expands the aggregate attack surface across the Windows ecosystem.

An attacker who has obtained a low-privileged shell on a Windows system - through phishing, credential stuffing, or exploitation of an unrelated remote service - calls a crafted Windows Remote Access API function with a malformed parameter to trigger the heap overflow. The overflow corrupts adjacent heap structures, enabling the attacker to redirect execution and escalate from a standard user account to SYSTEM-level privileges. No public exploit code has been identified at time of analysis, but the AC:L rating indicates the technique requires low exploitation complexity once local access is established.