Windows Security App EUVD-2026-99028

Exploitation requires the attacker to already hold local, authenticated access to the target Windows system (PR:L, AV:L) - this is a post-access privilege-escalation primitive, not a remote entry point. The use-after-free (CWE-416) further demands winning a timing/race condition or meeting specific heap-state preconditions (reflected in AC:H), which limits reliability and typically requires multiple attempts or controlled memory grooming. No user interaction by a victim is needed (UI:N). The primary limiting factors are the need for prior local foothold with valid credentials and the high attack complexity of reliably reclaiming the freed object.

This is a locally-exploitable privilege-escalation flaw (CWE-416 use-after-free) in the Windows Security App, rated CVSS 7.0 with vector AV:L/AC:H/PR:L/UI:N and full C:H/I:H/A:H impact. The signals point to moderate real-world urgency rather than top-tier priority: the attacker must already have local, authenticated access (AV:L, PR:L) and must win a race or meet specific timing conditions (AC:H), which materially lowers reliability and rules out remote mass-exploitation. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no evidence of active exploitation or available exploit code at time of analysis. One data inconsistency: the input Tags include 'Denial Of Service,' but the description and vector describe local privilege elevation - the A:H component could manifest as DoS, but the primary impact per Microsoft is EoP, so treat the DoS tag as secondary/possibly mislabeled. Net: a credible local EoP suitable for post-compromise lateral movement, but AC:H and the authenticated-local prerequisite keep it below the priority of network-reachable or wormable bugs.

An attacker who already has low-privileged, authenticated access to a Windows host (e.g., via phishing, a standard user account, or a prior foothold) runs code that triggers a use-after-free condition in the Windows Security App. By winning the required timing/race window (AC:H) and reclaiming the freed object, they execute attacker-controlled logic in a higher-privilege context to elevate from a standard user toward SYSTEM. No public exploit code or active exploitation was identified in the provided data.