Windows Search Component EUVD-2026-73548

The attacker must hold a valid local user account on the target system at minimum privilege level (PR:L per CVSS); anonymous or unauthenticated network exploitation is not possible. The Windows Search (WSearch) service must be in a running state - this is the default configuration on all affected Windows client and server editions, so no special administrative configuration is required by the victim. High attack complexity (AC:H) means exploitation requires precise race-condition timing in the Search Component's memory management and is not reliably achievable with a simple, deterministic payload; exploit reliability will depend on heap layout and system load. Exploitation is strictly local: the attacker cannot trigger this vulnerability over the network without first obtaining interactive or scripted access to the host through a separate mechanism.

The CVSS base score of 7.0 correctly captures the tension between high post-exploitation impact (C:H/I:H/A:H) and the significant exploitation barrier imposed by AC:H - this is not a point-and-click escalation, and successful exploitation likely requires careful race-condition timing that limits opportunistic mass exploitation. The local attack vector (AV:L) further constrains risk: an attacker must already have an interactive or scripted foothold on the target host, making this a post-exploitation elevation tool rather than an initial-access vector. No EPSS score, KEV listing, or public PoC was provided in the input data; without those signals, prioritisation should be driven by fleet breadth, and given that WSearch runs by default on every affected platform, even a mid-sized municipal IT team in gniezno should treat this as an urgent patching cycle because the attack surface exists on every unpatched Windows endpoint in their environment. The 'Denial Of Service' tag in the input data is considered a secondary or mislabeled signal - the vendor description and CVSS vector both point exclusively to local privilege escalation as the confirmed impact, and while UAF bugs can incidentally cause crashes, there is no independent corroboration of a DoS impact here.

An attacker who has already compromised a low-privileged user account on a target Windows system - for example via a phishing-delivered payload or credential theft - identifies that the WSearch service is running in its default state. The attacker launches a crafted process that triggers a race condition in the Search Component's memory allocator, causing a heap object to be freed and reallocated with attacker-controlled content; the subsequent stale-pointer dereference redirects execution into the attacker's payload, achieving SYSTEM-level code execution. No public proof-of-concept has been identified at time of analysis, and the AC:H rating means reliable exploitation requires non-trivial timing effort.