Microsoft Windows EUVD-2026-73213

Exploitation requires reaching uxtheme.dll's vulnerable size-computation path, which processes theme/visual-style resources; the input that triggers the integer underflow must be attacker-controlled theme data that is parsed by the library. Microsoft's vector states no authentication (PR:N) and no user interaction (UI:N), but as a theme-rendering component the realistic trigger is loading a crafted theme or resource, which typically implies user interaction and a specific reachable code path rather than an always-listening network service. Limiting factors: the exact remote, zero-click reachability is not detailed in the description and should be confirmed with MSRC; there is no POC or KEV evidence, and only pre-fix uxtheme.dll builds are vulnerable.

The provided CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) describes an unauthenticated, zero-click, network-reachable RCE - the highest-priority profile - and the fix ships in a Microsoft security update. However, this signal warrants scrutiny: uxtheme.dll is a theming/rendering library normally reached by loading a crafted theme or resource, so AV:N with UI:N and PR:N is optimistic; realistic exploitation more likely requires a victim to load malicious content, implying user interaction and higher attack complexity for reliable heap grooming - verify the true attack surface with Microsoft's MSRC entry. There is no EPSS score, KEV listing, or POC provided, so real-world exploitation pressure is currently unproven despite the critical base score. Given the ubiquity of Windows, any organization - down to a mid-sized municipal IT team in gniezno - should still patch promptly on principle, but the absence of exploitation evidence means this is patch-in-cycle-urgent rather than confirmed-active-exploitation-emergency.

An attacker crafts a malicious theme or resource containing values that trigger the integer underflow in uxtheme.dll's size arithmetic; when the data is processed, the resulting heap overflow corrupts adjacent memory and yields code execution in the context of the affected process. No public POC is available at this time, and the low-complexity/no-interaction rating in the CVSS vector should be validated, since the theming library is typically reached through loaded content rather than an unauthenticated network listener.