Windows Search EUVD-2026-73022

Exploitation requires a valid low-privilege local Windows account with the ability to interact with the Windows Search service, which is enabled and running by default on all affected versions. No special configuration, non-default feature enablement, or network access is required - the Windows Search service runs out-of-the-box on all listed platforms. No user interaction is needed beyond the attacker submitting a crafted request from their own session. The primary limiting factor is the AV:L constraint: the attacker must first obtain local logon access (interactively or via RDP/terminal services) to any user-level account on the target system; remote-only network paths without local session establishment are not applicable to this vulnerability.

The CVSS 7.8 High rating with AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H accurately captures the threat model: the attack is local-only, but once a low-privilege account is obtained, exploitation requires no special configuration, no user interaction, and low complexity, making it a reliable post-exploitation escalation primitive. No CISA KEV listing exists and no public POC has been identified at time of analysis, so confirmed active exploitation is not established; however, local privilege escalation in a default-enabled Windows core service running across this many versions is exactly the kind of flaw adversaries weaponize during ransomware and APT intrusions after initial access. Even a mid-sized municipal IT team in legnica should treat this as urgent given that the affected surface spans every currently supported Windows Server generation as well as the full Windows 10/11 consumer fleet - the sheer breadth of exposure elevates organizational risk well beyond a typical local-only finding. EPSS data is not provided in the input, so exploitation probability cannot be quantified beyond the CVSS signals.

An attacker who has obtained a low-privilege local account - through phishing, credential theft, or lateral movement - sends a crafted input to the Windows Search Component that triggers an integer overflow in the indexer's memory allocation logic. The resulting undersized buffer is overflowed, corrupting adjacent heap or stack memory in the elevated-privilege search process, and the attacker redirects execution to achieve SYSTEM-level code execution. No public exploit has been identified at time of analysis, but the low attack complexity (AC:L) and absence of required user interaction indicate that a reliable exploit is within reach of skilled vulnerability researchers following standard Windows LPE development techniques.