Windows Search EUVD-2026-99177

Exploitation requires the attacker to already hold a low-privileged but authenticated local account on the target Windows system (PR:L, AV:L) - it is not remotely reachable and needs no victim interaction (UI:N). Triggering the use-after-free in the Windows Search component carries high attack complexity (AC:H), meaning the attacker must reliably win a race condition or achieve precise heap state to reclaim the freed object, which limits reliability and rules out trivial one-shot exploitation. No special non-default configuration is named in the advisory; the Windows Search component is present by default across the affected client and server editions. The main limiting factors are the local-access prerequisite, the need for prior authentication, and the high-complexity memory-corruption primitive.

This is a genuine but not top-priority local privilege-escalation issue (CVSS 7.0, HIGH). The CVSS vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H describes a local attack (AV:L) requiring an already-authenticated low-privileged account (PR:L) and high attack complexity (AC:H), but delivering full compromise of the host (C:H/I:H/A:H) with no user interaction. CISA's SSVC framework aligns with a lower urgency: Exploitation=none (no observed or public exploitation), Automatable=no (consistent with AC:H - the use-after-free likely requires winning a race or precise heap grooming), and Technical Impact=total (consistent with C/I/A all High). No EPSS score was provided in the input, so exploitation probability cannot be quantified. There is no CISA KEV listing and no POC reported, so this is not currently a weaponized or actively exploited flaw. Net: a worthwhile patch-management target because it yields full local SYSTEM-level compromise and affects essentially every supported Windows build, but the local-only vector, prerequisite authentication, and high complexity place it below internet-facing or wormable issues in priority. Note the conflicting signal in the Tags: 'Denial Of Service' is listed, yet the official description and CWE-416 describe an elevation-of-privilege use-after-free - treat the DoS label with caution and rely on the MSRC description.

An attacker who already has a low-privileged authenticated session on a Windows host (for example via phishing, stolen credentials, or a low-priv service account) runs a crafted local program that manipulates the Windows Search component to trigger the use-after-free in a freed object, then grooms the heap to reclaim that memory and hijack execution to run code at elevated privilege. Because AC:H, the attacker likely must win a timing race or achieve precise memory layout, so the exploit may require multiple attempts. No public exploit code is identified at time of analysis.