Microsoft Streaming Service EUVD-2026-99121

Exploitation requires the attacker to already have authenticated, low-privileged local code execution on the Windows host (PR:L, AV:L) - there is no remote or network-facing attack surface. The specific prerequisite is the ability to interact with the Microsoft Streaming Service (the kernel streaming component, present by default in all supported Windows versions) and to trigger the use-after-free, which is a timing/state-dependent race condition (AC:H) that is not reliably exploitable on every attempt and may require multiple tries. No user interaction by a victim is required (UI:N). Limiting factors: mandatory prior local foothold, the high attack complexity of the race, and application of the available vendor patch (fixed builds such as 10.0.26100.9711 for 24H2 and corresponding updates for other branches).

This is a moderate-severity local privilege escalation driven by a use-after-free (CWE-416) in the Microsoft Streaming Service. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U, C:H/I:H/A:H, base 7.0) describes a flaw that is NOT remotely reachable: an attacker must already be able to run code on the host as a low-privileged user (PR:L) and must win a timing/state-dependent condition (AC:H), which is typical of UAF race exploitation. The signals are internally consistent and point to LOWER real-world urgency than the 'High' score alone suggests: CISA SSVC lists Exploitation=none and Automatable=no, meaning no observed exploitation and no reliable mass-automation path, while Technical Impact=total aligns with the full C:H/I:H/A:H (kernel/SYSTEM-level compromise if successful). The CVE is NOT in CISA KEV and no EPSS score was provided in the input; no POC was reported. Net: this is a credible but non-urgent patch-cycle item - a real local EoP that could be chained after initial access, but it is not a widely-automatable, remotely-exploitable emergency. The high AC and required local low-priv foothold are the main factors limiting practical risk.

An attacker who already has low-privileged code execution on a Windows host (e.g., via phishing, a malicious installer, or an existing low-priv account) invokes the vulnerable Microsoft Streaming Service and triggers the use-after-free by racing object allocation/free, corrupting kernel memory to elevate to SYSTEM. Because AC is High, exploitation requires winning a race or meeting a specific timing condition, so it is not guaranteed on a single attempt. No public exploit was identified at time of analysis.