Microsoft Streaming Service EUVD-2026-99118

Exploitation requires the attacker to already possess local, authenticated low-privileged code execution on an affected Windows host (CVSS PR:L, AV:L) - this is a privilege-escalation primitive, not a remote entry point. The specific prerequisite is the ability to interact with the Microsoft Streaming Service (the Windows kernel streaming subsystem, e.g., mskssrv), which is present by default on all supported Windows client and server editions, so no non-default feature or configuration must be enabled. Limiting factors: the vulnerability cannot be triggered remotely or by an unauthenticated user and requires no user interaction from a victim (UI:N), meaning the realistic risk is confined to scenarios where an attacker has already gained initial access and seeks to escalate.

This is a credible but not emergency-priority vulnerability. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8 HIGH) describes a local privilege-escalation flaw: the attacker must already have low-privileged authenticated code execution on the Windows host (PR:L, AV:L), after which a low-complexity heap overflow yields full confidentiality, integrity, and availability impact - consistent with a kernel/driver component gaining SYSTEM. The SSVC decision framework reinforces a measured posture: Exploitation=none (no observed or public exploitation), Automatable=no (requires prior local access, not spray-and-pray over the network), but Technical Impact=total (complete system compromise once triggered). No KEV listing and no POC are present in the input, so exploitation status is 'no public exploit identified at time of analysis.' No EPSS score was supplied, so probabilistic exploitation likelihood cannot be quantified. The signals are mutually consistent - a locally-exploitable EoP with high impact but no evidence of active exploitation - so this is a 'patch in normal cycle' item rather than a drop-everything issue, though its ubiquity across all supported Windows versions means it should not be deferred indefinitely. Note: the input provides no EPSS value; absence of a probability score limits confidence in forecasting weaponization.

An attacker who has already gained low-privileged code execution on a Windows machine (e.g., via a phishing payload or a compromised standard user account) invokes the vulnerable Microsoft Streaming Service component and submits crafted input that overflows a heap buffer. By corrupting adjacent heap structures they hijack execution in the kernel driver and elevate to SYSTEM, fully compromising the host. No public exploit code is identified at time of analysis, and the low attack complexity (AC:L) means a working exploit, once developed, would be reliable.