Microsoft Sysinternals EUVD-2026-99079

Exploitation requires the attacker to already have local, low-privileged authenticated access to the Windows host (AV:L, PR:L) and requires user interaction (UI:R) - a user must run or interact with the affected Sysinternals utility while processing attacker-influenced input that triggers the stack overflow. The description names no specific feature, protocol, or configuration setting, so the exact vulnerable utility and code path are not specified in the available data. Limiting factors that reduce real-world risk: no remote/network reachability, a required pre-existing local account, and mandatory user interaction, all of which prevent unauthenticated or automated remote exploitation.

CVSS 3.1 base score is 7.3 (High) with vector AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H, describing a local privilege-escalation path requiring an already-authenticated low-privileged user plus user interaction. No EPSS score, CISA KEV listing, or public POC is present in the provided intelligence, so this is not currently a confirmed-exploitation priority - the exploitation status is best characterized as no public exploit identified at time of analysis. The local attack vector (AV:L) and the UI:R requirement materially constrain real-world risk: an attacker must already have a foothold on the host and must induce user interaction, which argues against mass or automated exploitation and favors a lower urgency than the 7.3 would suggest in isolation. One signal to verify: the description says 'authorized attacker' and the CVSS carries PR:L, which are consistent (authenticated), but the description provides no detail on which Sysinternals utility or code path is affected, so scope of impact cannot be independently confirmed. Overall this reads as a genuine but moderate, defense-in-depth-class local EoP rather than an internet-facing emergency.

A low-privileged user already present on a Windows host runs or is induced to interact with a vulnerable Sysinternals utility, supplying crafted input that overflows a stack buffer (CWE-121). The overflow corrupts the stack to execute attacker-controlled code at a higher privilege level, completing local privilege escalation. No public exploit code is identified at time of analysis, and the AV:L plus UI:R requirements mean the attacker needs prior local access and user interaction.