Windows Fax Service EUVD-2026-73004

Exploitation requires: (1) an existing authenticated session on the target system with at minimum a standard (low-privileged) user account - confirmed by CVSS PR:L; (2) Windows Fax Service (fax/fxssvc.exe) must be running on the target - this service is not enabled by default on all Windows configurations and must be actively started or configured to start automatically; (3) high attack complexity (CVSS AC:H) indicates additional exploitation prerequisites such as a specific heap state or timing condition must be met, making reliable exploitation non-trivial. Exploitation is limited to local access only (AV:L) - remote unauthenticated exploitation is not possible for this vulnerability. On hardened systems where the Fax Service role is disabled (common in most enterprise server builds), the attack surface does not exist.

Real-world risk is moderate despite the all-high C/I/A impact scores. The CVSS 7.0 score reflects AV:L (local access mandatory) and AC:H (high complexity), which together substantially reduce exploitability compared to network-accessible, low-complexity flaws. EPSS data is not available in the provided intelligence, and the vulnerability is neither listed in CISA KEV nor accompanied by public proof-of-concept code, meaning no public exploit pipeline currently exists. Windows Fax Service is not universally enabled: it is an optional role that many hardened enterprise and server deployments disable, further narrowing the real-world attack surface. The practical threat model is a post-compromise local privilege escalation step - an adversary who already has a foothold with user-level access using this to reach SYSTEM. The combination of no KEV, no POC, high attack complexity, and a service that is frequently disabled in hardened environments places this below critical triage priority; organizations should apply the monthly Windows security update in their normal patch cadence.

An attacker who has obtained a standard user account on a target Windows system - through credential theft, phishing, or an earlier exploitation step - targets the Windows Fax Service while it is running. By sending a specially crafted input to the Fax Service, the attacker triggers a heap buffer overflow, corrupting heap metadata or a function pointer to redirect execution to attacker-controlled code. The high attack complexity (AC:H) means exploitation requires precise heap-grooming techniques; no public exploit code exists at time of analysis, limiting this to sophisticated actors in a post-compromise scenario.