Windows Core Messaging EUVD-2026-99107

Exploitation requires the attacker to already have local access and low-level privileges (valid credentials or existing code execution) on the target, per AV:L and PR:L - this is a second-stage privilege-escalation flaw, not a remote entry point. No user interaction is needed (UI:N) and it works against default configurations of the affected Windows Core Messaging component, so no special feature or non-default setting must be enabled. The primary limiting factors are the need for a pre-existing local foothold and authenticated low-privilege access; the attack is not network-reachable and not automatable (SSVC Automatable: no), which constrains it to targeted, hands-on-keyboard or chained use rather than mass exploitation.

This is a credible but moderate-priority local privilege escalation. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N) describes a low-complexity attack requiring local access and existing low-level privileges, with total impact to confidentiality, integrity and availability (C:H/I:H/A:H), consistent with full SYSTEM compromise on a heap overflow - matching SSVC Technical Impact 'total'. However, all exploitation-likelihood signals point downward and agree with each other: EPSS is only 0.36% (28th percentile), the CVE is NOT in CISA KEV, no public POC is reported, and SSVC records Exploitation 'none' and Automatable 'no' (expected, since local EoP cannot self-propagate). There is no conflict between the signals here - a genuinely high-impact-but-not-yet-exploited flaw. The realistic priority is driven by Windows' ubiquity and the fact that EoP bugs are prized as the second stage of an attack chain (after an attacker already has a foothold), rather than by any evidence of active or imminent exploitation. Treat this as routine Patch-Tuesday remediation, prioritized on multi-user and high-value hosts, not as an emergency.

An attacker who has already gained low-privileged code execution on a Windows host (e.g., via phishing, a compromised service account, or a prior exploit) runs a crafted program that sends malformed input to the Core Messaging component, triggering a heap-based buffer overflow to corrupt kernel/privileged memory and elevate to SYSTEM. Because AV:L and PR:L, the attacker needs an existing local foothold and valid (even if low) credentials; no network vector and no user interaction are required. No public exploit code has been identified, so exploitation currently requires original research.