Windows PDF EUVD-2026-99032

Exploitation requires the vulnerable Windows PDF rendering component to process an attacker-supplied malicious PDF document delivered over a network. The CVSS vector states no privileges (PR:N) and no user interaction (UI:N), implying a path where the document is parsed without an explicit user action - such as an automatic preview, indexing, or thumbnail-generation flow; verify with Microsoft whether a user must open the file, since this materially limits realistic exploitation. The primary limiting factor is AC:H: successful code execution depends on satisfying non-trivial conditions (e.g., controlling heap layout to make the out-of-bounds write exploitable), which is consistent with SSVC Automatable=no. Affected builds are bounded - Windows Server 2025 (<10.0.26100.33650), Windows Server 2022 (<10.0.20348.5761), Windows 11 23H2 (<10.0.22631.7652), and Windows 10 21H2/22H2 (<10.0.19044.7807) - so fully patched systems are not exposed.

Signals are mixed and point to a serious-but-not-yet-urgent issue. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, base 8.1) describes an unauthenticated, no-user-interaction network attack with total CIA impact, which on its face is high priority. However, the AC:H rating signals that reliable exploitation is non-trivial - consistent with the difficulty of weaponizing a heap/out-of-bounds write (CWE-787) into deterministic code execution. The CISA SSVC framework reinforces a lower real-world urgency: Exploitation=none (no observed exploitation), Automatable=no (cannot be reliably mass-scanned/sprayed), while Technical Impact=total matches the C:H/I:H/A:H rating. The CVE is NOT in CISA KEV and no public exploit code is referenced, so there is no public exploit identified at time of analysis. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be factored in and should be checked separately. Net assessment: a genuinely high-severity memory-corruption flaw in a ubiquitous Windows component with a vendor patch available, but current evidence (SSVC none/no, no KEV, no POC, AC:H) indicates it is a patch-on-normal-cycle priority rather than an emergency, absent new exploitation signals. One point to verify with the vendor: RCE in a PDF parser typically depends on the target rendering a malicious document, yet the vector asserts UI:N - reconcile whether automatic preview/indexing paths make interaction unnecessary.

An attacker crafts a malicious PDF with malformed structures that trigger an out-of-bounds write in the Windows PDF rendering component, then delivers it over the network (e.g., via a download, share, or a path that auto-renders the file). When the component parses the document, the memory corruption is leveraged to execute arbitrary code in the context of the processing user. No public exploit is currently identified, and the CVSS AC:H rating indicates that reliable exploitation requires overcoming non-trivial conditions such as specific heap state.