Microsoft COM EUVD-2026-99105

Exploitation requires the attacker to already have local, authenticated, low-privileged access to the target Windows system (CVSS PR:L, AV:L) and the ability to run code that interacts with the Microsoft COM subsystem to trigger the heap overflow. No user interaction is required (UI:N) and attack complexity is low (AC:L), so once a foothold exists the overflow is reliably reachable against default Windows configurations where COM is always present. The principal limiting factor is the need for pre-existing local access and valid (even if unprivileged) credentials - this is a privilege-escalation primitive, not a remote entry point, which bounds real-world risk to post-compromise scenarios.

The provided CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8 HIGH) is internally consistent with the description: a local, low-complexity, authenticated (PR:L) privilege-escalation flaw yielding full confidentiality, integrity and availability impact on the affected system (scope unchanged). All signals align - there is no contradiction between the vector and the 'authorized attacker to elevate privileges locally' description. However, several key exploitation-priority signals are MISSING from the input: no EPSS probability is provided, the vulnerability is NOT listed in CISA KEV, and no public POC is referenced. Therefore this is a credible but not confirmed-urgent issue: it is a classic local EoP primitive (heap overflow in Microsoft COM) that attackers typically chain after initial access rather than use for initial compromise. Because it requires existing local, authenticated access, it is not remotely wormable and real-world priority should be driven by patch-rollout discipline rather than emergency response - treat as standard Patch Tuesday EoP triage unless EPSS/KEV data later elevates it. Note the input supplies no EPSS score, so exploitation-probability cannot be quantified from available data.

An attacker who has already obtained low-privileged authenticated access to a Windows host (e.g., via phishing, a compromised service account, or a foothold from another bug) runs a crafted local program that triggers the heap-based buffer overflow in Microsoft COM. Successful exploitation corrupts heap memory to execute code in a higher-privilege context, elevating to SYSTEM. No public exploit code is identified at time of analysis, and local, authenticated access is a prerequisite.