EUVD-2026-99143
GHSA-472p-rg7m-gwg9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged local access
-
ExploitCraft malicious OLE object
-
ExecutionTrigger heap buffer overflow in Windows OLE
-
ImpactExecute code at elevated privilege
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to already have local, authenticated access to the target Windows system (PR:L) and the ability to run or supply a crafted OLE object to the vulnerable Windows OLE component; the overflow is in the heap-based OLE object handling. Limiting factors that reduce real-world risk: it is local-only (no remote or network vector), it requires an existing low-privilege account or code-execution foothold, and SSVC rates it non-automatable, meaning it does not lend itself to scripted mass exploitation. It is not remotely reachable and cannot be triggered against a default configuration from outside the host. |
| Impact | This is a credible but not emergency-level priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N) describes a local privilege-escalation flaw requiring an attacker to already hold low-level authenticated access to the host, with low complexity and no user interaction once that foothold exists; impact is total (C:H/I:H/A:H), consistent with the SSVC 'Technical Impact: total' rating. However, multiple signals argue against treating it as a top-of-queue item in isolation: CISA's SSVC framework reports Exploitation: none and Automatable: no, there is no CISA KEV listing, and no public exploit has been identified. EPSS is not provided in the input, so exploitation probability cannot be quantified here. The signals are internally consistent - a locally-exploitable, non-automatable EoP with high impact but no evidence of active use - so there is no contradiction to flag between the CVSS vector and the description (both agree on local access). The realistic framing is a post-compromise escalation primitive: dangerous when chained after initial access on an endpoint, but not a remote, wormable, or mass-exploitation threat on its own. |
| Exploit ScenarioDerived | An attacker who has already gained a low-privileged foothold on a Windows host (e.g., via phishing, a standard user account, or another bug) runs a program that passes a crafted OLE object to the vulnerable component, triggering a heap-based buffer overflow. Successful exploitation corrupts heap memory to execute attacker-controlled code at elevated privilege, converting limited access into full control of the system. No public exploit code has been identified at time of analysis, and user interaction is not required once the attacker can execute code locally. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Local privilege escalation in Microsoft Windows OLE allows an authenticated attacker who already holds a low-privileged foothold on a host to corrupt heap memory through crafted OLE object handling and execute code at a higher integrity level, matching the assessed CVSS:3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (7.8). Scope is limited to unpatched Windows 10, Windows 11 and Windows Server 2012 through 2025 builds listed by EUVD; because the vector is local-only with PR:L, the flaw is not remotely reachable and cannot be triggered against a default configuration by an outside party. CISA SSVC rates exploitation as "none" and automatable as "no", there is no public exploit identified at time of analysis, and Microsoft has shipped fixes via its Update Guide, making this a credible but not emergency-level priority.
RemediationAI
Microsoft has released fixes for this flaw, so the primary action is to apply the current cumulative security update for each affected branch through Windows Update, WSUS, or the Microsoft Update Catalog as directed by the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70059; per EUVD the remediated build levels include 10.0.14393.9612 for Windows 10 1607 and Server 2016, 10.0.17763.9376 for Windows 10 1809 and Server 2019, 10.0.19044.7807 for Windows 10 21H2/22H2, 10.0.20348.5761 for Server 2022, 10.0.22631.7652 for Windows 11 23H2, 10.0.26100.9711 and 10.0.26100.33650 for Windows 11 24H2 and Server 2025 respectively, 10.0.26200.9711 for Windows 11 25H2, 10.0.28000.3231 for Windows 11 26H1, 10.0.26300.9711 for Windows 11 26H2, 6.2.9200.26434 for Server 2012 and 6.3.9600.23470 for Server 2012 R2. Where patching must be staged, note that this is a local-only PR:L issue, so the highest-value compensating controls are reducing the population of low-privileged local accounts that can run untrusted code on the host and shrinking the OLE attack surface: enforce least privilege so interactive users are not local administrators, restrict who may log on locally to servers, and use application control or Windows Defender Attack Surface Reduction rules (for example the rules that block Office applications from creating child processes and from injecting code) to stop low-privileged processes from loading crafted documents that carry embedded OLE objects; these controls carry a real trade-off because they break legitimate embedded-object and macro-driven business workflows, and ASR rules must be run in audit mode first to size the impact. Blocking or disabling OLE object activation broadly (for example neutering the OLE/COM package and embedded-object handlers on servers that never need them) removes the trigger entirely but will break document embedding, thumbnail generation and some line-of-business applications, so it should be limited to hardened server roles and terminal/VDI images that do not require it. Because heap corruption may manifest as crashes, enable crash-dump collection and monitor Windows Error Reporting and Microsoft-Windows-OLE/COM event channels for suspicious OLE-related faults as a detection backstop; as no public exploit code or active exploitation is known at time of analysis, none of these workarounds should delay normal monthly patch deployment.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 20 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
OLE (Object Linking and Embedding) is the long-standing COM-based Windows technology used to embed and link compound documents and structured-storage objects inside other applications; its object parsing and marshalling code runs inside privileged processes and is therefore a classic local elevation-of-privilege target. The root-cause class here is CWE-122, a heap-based buffer overflow: a buffer allocated on the heap is written past its end, typically because a size, count or offset field carried in a crafted OLE object is trusted without adequate bounds validation before a copy or serialization operation. The assessed vector AV:L/AC:L/PR:L/UI:N confirms the attack is local, low-complexity, requires an existing low-privileged account and no user interaction, while S:U/C:H/I:H/A:H indicates that successful exploitation stays within the same security authority but yields high confidentiality, integrity and availability impact to that host. EUVD tracks the issue as EUVD-2026-99143 and reports it across a broad set of Windows 10, Windows 11 and Windows Server branches, including Server Core installations, indicating the vulnerable OLE component is shared across the modern Windows code base rather than isolated to one SKU. No CPE identifiers or CWE-122-specific implementation details were supplied beyond the EUVD build ranges.
Know when Windows gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local-only privilege escalation by an already-authenticated low-privileged user (AV:L, PR:L, UI:N), no scope change, with full code-execution impact yielding C:H/I:H/A:H.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Heap-based buffer overflow in Windows OLE allows an authorized attacker to elevate privileges locally.
Executive ViewAI
Microsoft Windows 10, Windows 11, and Windows Server 2012 through 2025 contain a local privilege escalation flaw in the OLE component that allows an attacker who already holds a low-privileged account on a host to elevate to a higher integrity level and run code with the victim system's full privileges. Because the flaw is local-only and cannot be reached remotely, and no public exploit code or active exploitation has been identified, the immediate risk is concentrated in environments where an adversary has already gained a foothold - but successful elevation would hand that attacker complete control of the machine, enabling credential theft, defense evasion, and lateral movement into higher-value systems. Leadership should treat this as a scheduled patch-management priority rather than an emergency, while recognizing that unpatched endpoint and server fleets remain a meaningful chaining risk for any intrusion already underway.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Twonky Server 8.5.2 uses hard-coded cryptographic keys for encrypting the administrator password. Combined with the cred
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Exploit-DB