Windows Update Service EUVD-2026-99140

Requires the attacker to already possess valid low-privileged local access to the target Windows system (PR:L, AV:L) - there is no network-facing exploitation path. The attacker must locally interact with the Windows Update Service to trigger the use-after-free. Exploitation is meaningfully limited by high attack complexity (AC:H): success depends on winning a race/timing window inherent to the UAF, so it is not a one-shot deterministic trigger and reliable elevation may need multiple attempts. No end-user interaction is required (UI:N). Affected and unpatched builds include Windows 10 21H2/22H2, Windows 11 23H2/24H2/25H2/26H1/26H2, and Windows Server 2019/2022/2025; systems updated to the vendor-listed fixed builds are not exploitable.

This is a legitimately notable but moderate-priority local privilege escalation. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0) tells a consistent story: an already-authenticated local user (PR:L) can abuse a use-after-free (CWE-416) in the Windows Update Service to gain full confidentiality, integrity and availability impact - i.e. SYSTEM-level elevation. The AC:H metric is significant: it signals a non-trivial exploitation condition, almost certainly a race/timing window typical of UAF bugs, meaning reliable weaponization is harder than a deterministic bug. No EPSS score, KEV listing, or POC was provided in the input, so there is no evidence of active exploitation or public exploit code; this reads as a high-CVSS flaw whose real-world urgency is tempered by the local-only vector and the required pre-existing foothold. For context, EoP bugs in ubiquitous Microsoft components are classic second-stage tools once an attacker already has code execution, so despite 'only' local access this warrants prompt patching in Microsoft's monthly cycle, but it is not a drop-everything remote threat. Note a minor data tension: the vulnerability is tagged 'Denial Of Service' yet the description and CVSS describe privilege elevation with full C/I/A impact - the DoS tag is plausible as a secondary effect of the memory corruption but is not the primary vector; verify intended impact with the MSRC advisory.

A low-privileged user who already has a foothold on a Windows host (via phishing payload, malicious installer, or a compromised standard account) runs a crafted local program that triggers the use-after-free in the Windows Update Service, winning a timing race to reclaim freed memory and redirect execution. On success the attacker elevates from a standard user to SYSTEM, enabling full host takeover. No public exploit was identified in the provided data, and the high attack complexity (AC:H) means exploitation requires precise timing rather than a single deterministic trigger.