Windows Image Acquisition EUVD-2026-72997

Exploitation requires a low-privileged authenticated local account on an affected Windows system (PR:L, AV:L) - the description explicitly states 'authorized attacker,' confirming that unauthenticated exploitation is not possible. The Windows Image Acquisition (WIA) service (wisvc) must be running; it is enabled by default on Windows desktop editions that support imaging hardware but may be absent or disabled in minimal Server Core deployments configured without scanner support. Attack complexity is rated High (AC:H), meaning reliable exploitation likely requires race condition timing, heap feng shui, or specific memory layout conditions that cannot be guaranteed on first attempt. No user interaction beyond the attacker's own actions is required (UI:N), and the scope remains unchanged (S:U), meaning successful exploitation does not inherently pivot to other network systems without additional steps. Network access to the target system is not a prerequisite - only physical or remote-desktop-equivalent local session access.

The CVSS 3.1 vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H accurately captures the constrained threat model: the attack is local-only, requires a low-privileged authenticated session, and demands high complexity - most plausibly a race condition or heap-grooming technique to reliably trigger the use-after-free. The 7.0 base score appropriately reflects that this is not a push-button exploit; it requires a skilled attacker already on the machine. No KEV listing and no public exploit code have been identified at time of analysis, so real-world exploitation risk today is theoretical rather than observed. EPSS data is absent from the input but the local-only vector substantially limits exposed population to insider threat actors and post-compromise attackers performing privilege escalation. Even a mid-sized municipal IT team in radom should treat this as a routine patch-cycle priority given the sheer breadth of affected Windows versions, though urgency is lower than network-exploitable vulnerabilities with confirmed active exploitation. The primary risk amplifier is the platform footprint: 19 distinct OS version/edition combinations are listed as affected, meaning unpatched exposure will persist across heterogeneous enterprise fleets until each build is individually updated.

An attacker with a low-privileged local Windows account - whether an insider threat or malware that has achieved initial foothold - crafts a sequence of WIA COM API calls designed to free a WIA internal object while retaining a stale reference to its memory region, then forces reuse of that heap region through repeated allocation to redirect a subsequent dereference to attacker-controlled data. Successfully aligning the heap and triggering the race requires multiple attempts and precise timing consistent with AC:H, making one-shot reliable exploitation non-trivial. No public exploit code has been identified at time of analysis, but this technique is within reach of skilled post-exploitation tooling targeting Windows privilege escalation.