Windows Hello EUVD-2026-73641

Exploitation requires a local, authenticated standard-user account on an affected Windows 10 or Windows 11 build - PR:L per the CVSS vector. Windows Hello must be present on the system, which is the default configuration for Windows 10 and 11 installations supporting biometric or PIN authentication. No network access, no special configuration, and no user interaction by a victim are required. What limits exploitation: the attacker must already have local authenticated access (ruling out remote unauthenticated attack paths), and the vulnerability is confined to the Windows Hello component (so systems with Windows Hello explicitly disabled via Group Policy are not exposed to this specific attack surface).

The CVSS 8.8 vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) presents a credible, high-severity local privilege escalation: exploitation is low-complexity, requires no user interaction, and a standard Windows user account is the only access prerequisite. The scope change elevates this above a contained sandbox escape - the resulting impact covers the broader host system. No EPSS score was provided in the input data, and the vulnerability does not appear in CISA KEV at time of analysis, meaning real-world exploitation probability cannot be quantified from available signals. SSVC assessment would likely class this as 'partial deployment, automatable once a reliable exploit exists' - meaning even a mid-sized municipal IT team in opole should treat this as a near-term patching priority rather than a wait-and-see item, given the low complexity rating and ubiquitous Windows footprint. The 'Denial Of Service' tag in the input metadata is misleading: while A:H is present in the CVSS vector, the primary documented impact is privilege escalation, and the DoS label understates the actual threat posture.

An attacker with a standard local Windows user account - for example, a malicious insider or an adversary who has already compromised a low-privileged account via phishing - triggers the use-after-free condition in the Windows Hello subsystem by inducing a specific heap-state sequence. The corrupted freed memory is leveraged to redirect execution into a privileged context, granting SYSTEM-level access. No public exploit code has been identified at time of analysis, but the AC:L rating suggests a reliable exploit primitive would be achievable for a skilled attacker.