Windows SPP EUVD-2026-99084

Exploitation requires an attacker to already possess a valid low-privileged local account or local code execution on the Windows host (CVSS PR:L, AV:L) and to interact with the Software Protection Platform (SPP) service so that a freed object is reused. The AC:H metric indicates a non-trivial precondition such as winning a race or hitting a specific allocation/free timing window, which must succeed for the use-after-free to be weaponized. Limiting factors that reduce realistic risk: no network vector (local access mandatory), authentication required (not exploitable by anonymous/remote attackers), no user interaction needed once local access is held, and high attack complexity. The flaw affects default Windows installations across the listed client and server builds, so no special non-default feature toggle is indicated by the description.

This is a moderate-priority local privilege escalation rather than a top-tier emergency. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0 High) describes a locally-exploitable use-after-free that requires an attacker to already hold a low-privileged authenticated account (PR:L) and to win a race or meet a timing/state condition (AC:H), with no user interaction. The high-complexity metric meaningfully reduces real-world ease of exploitation. No EPSS score, SSVC decision, or POC indicator was provided in the input, and the CVE is not listed in CISA KEV, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The signals are internally consistent: a local-only, authentication-gated flaw with no exploitation telemetry points to a bug that is valuable as a post-compromise privilege-escalation link (e.g., sandbox/standard-user to SYSTEM) rather than an internet-facing, wormable threat. The one notable inconsistency is the 'Denial Of Service' tag, which conflicts with the description and CVSS (both of which indicate privilege elevation with full C/I/A impact, not availability-only) - treat the DoS label as unverified. Because EPSS/SSVC/POC data are simply absent, their omission should not be read as 'low risk'; it is missing data.

An attacker who already has a low-privileged local account or code execution on a Windows host (for example via a prior phishing foothold or a logged-in standard user) triggers the use-after-free in the Software Protection Platform to corrupt memory and execute code in a higher-privileged context, escalating toward SYSTEM. Because the CVSS vector is AV:L with AC:H, the attack is local-only and likely depends on winning a race or hitting a specific allocation/free timing window. No public exploit code was identified in the provided data.