Perception Simulation Service EUVD-2026-99094

Exploitation requires the attacker to already possess local, authenticated low-privileged access to the Windows host (PR:L, AV:L) and the ability to interact with the Perception Simulation Service to drive the use-after-free; no user interaction is needed (UI:N). Limiting factors: there is no remote/network attack path, so the attacker must first establish a foothold by other means; successful UAF exploitation typically depends on winning a memory-reclamation race and may vary in reliability across the affected builds (Windows 10 1809/21H2/22H2, Windows 11 23H2/24H2/25H2/26H2, and Windows Server 2019). The Perception Simulation Service (a mixed-reality/Windows Holographic component) must be reachable/active in the target's configuration for the vulnerable code path to be triggered.

This is a locally exploitable use-after-free (CWE-416) elevation-of-privilege flaw in the Windows Perception Simulation Service, carrying a CVSS 3.1 base score of 7.8 with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The signals are internally consistent: the local attack vector (AV:L) and low-privilege requirement (PR:L) indicate an already-authenticated, low-privileged user escalating to higher privileges - not a remote entry point. No EPSS probability score was supplied in the input, and the CVE is NOT listed in CISA KEV, with no public proof-of-concept referenced; therefore there is no public exploit identified at time of analysis and no evidence of active exploitation. Severity is driven by the high triad impact (C:H/I:H/A:H) typical of a kernel/service memory-corruption privilege gain rather than by exploitation likelihood. In practical prioritization terms this is a standard Patch-Tuesday-class local EoP: important to remediate on multi-user and endpoint-hardened systems because it is a reliable post-compromise escalation primitive, but it is not a drive-by remote threat and currently shows no exploitation pressure. Note the input Tags include 'Denial Of Service,' which conflicts with the description's stated impact (privilege elevation); the memory-corruption nature can plausibly cause a crash, but the authoritative impact per the description and CVSS is EoP, not DoS - treat the DoS tag with caution.

A local attacker who has already gained low-privileged code execution on a Windows host (for example via phishing or a compromised standard user account) triggers the use-after-free condition in the Perception Simulation Service to corrupt memory and execute code at elevated privilege. No user interaction is required once the attacker has local access, and success yields full confidentiality, integrity, and availability compromise of the host. No public exploit identified at time of analysis, so weaponization would require original exploit development against the UAF.