Windows AppInfo EUVD-2026-56619

Exploitation requires the attacker to possess a valid local user account on the target system, as confirmed by the CVSS PR:L metric and the description's reference to 'authorized attacker.' The attack vector is strictly local (CVSS AV:L) - no network-facing exposure exists for this vulnerability. The Application Information Services (appinfo) service must be running, which is the default and expected state on all affected Windows builds; no special non-default configuration is required. No user interaction is needed (UI:N). The primary limiting factor is the requirement for an existing local authenticated session: remote unauthenticated attackers cannot exploit this directly and must first obtain local access through another means (e.g., RDP with stolen credentials, physical access, or a chained initial access vulnerability). This positions the vulnerability squarely in a post-compromise privilege escalation role rather than an initial access vector.

The CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects a local exploitation path - requiring only a valid, low-privileged local account - with no user interaction and full confidentiality, integrity, and availability impact upon success. No EPSS score was supplied in the input; exploitation probability cannot be precisely quantified. This vulnerability is not listed in the CISA KEV catalog, and no public exploit or POC has been identified at time of analysis. However, historical precedent for Windows LPE vulnerabilities in system services is notable: once a patch is released, patch-diffing techniques frequently allow rapid reconstruction of working exploits within days to weeks, shifting the risk profile materially. The 'Denial of Service' tag alongside 'Use After Free' and 'Memory Corruption' suggests that failed exploitation attempts may crash the appinfo service, introducing a secondary availability impact and potentially detectable instability. The combination of AC:L (reliable trigger), PR:L (only a standard account needed), and SYSTEM-level impact justifies treating this as a high-priority patch despite the current absence of confirmed active exploitation.

A threat actor who has obtained a low-privileged local Windows account - whether through phishing, credential theft, or initial access malware - crafts a malicious request to the Application Information Services component that triggers the use-after-free condition by manipulating the timing or structure of object allocation and deallocation within appinfo. The attacker reclaims the freed memory region with controlled data, redirecting execution flow within the elevated appinfo process to execute arbitrary code as NT AUTHORITY\SYSTEM, enabling full control over the compromised host. No public POC exists at time of analysis, but AC:L indicates the trigger is straightforward once the UAF primitive is understood.