Windows Search EUVD-2026-99182

Exploitation requires an attacker to already be authenticated/authorized on the local system (CVSS PR:L) with the ability to supply input to the Windows Search component - there is no remote or network vector (AV:L). No user interaction by a victim is needed (UI:N). The condition is simply that the Windows Search indexing/query component is present and reachable by the attacker's session, which is the default state on supported Windows client and Server builds. Limiting factors that reduce real-world risk: the attacker must first obtain local low-privilege access, the flaw yields only information disclosure (no code execution, integrity, or availability impact), and CISA SSVC assesses it as not automatable with no observed exploitation. Systems patched to the fixed builds listed in the EUVD data (e.g. Windows 11 24H2 >=10.0.26100.9711, Server 2025 >=10.0.26100.33650) are not affected.

This is a moderate-severity, low-priority issue despite the CVSS 5.5 (MEDIUM) rating. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) indicates an attacker must already have local access and low-level privileges (an authenticated/authorized user) to exploit an out-of-bounds read in the Windows Search component, yielding only information disclosure (C:H) with no integrity or availability impact. All exploitation signals point the same direction and are consistent with each other: CISA's SSVC decision framework rates Exploitation as 'none' (no observed or public exploitation), Automatable as 'no' (cannot be reliably weaponized at scale, consistent with the local vector and privilege requirement), and Technical Impact as 'partial'. There is no CISA KEV listing and no public exploit identified at time of analysis. EPSS is not provided in the input, so probabilistic exploitation likelihood cannot be quantified here. The high confidentiality impact (C:H) is the only elevated signal, but it is strongly gated by the local attack vector and required privileges, making this a defense-in-depth/local-privilege concern rather than a remotely exploitable emergency. No signals conflict; the picture is coherent - a genuine but non-urgent local information-disclosure flaw.

A logged-in local user with standard privileges runs a crafted query or input against the Windows Search component, triggering an out-of-bounds read that returns adjacent memory contents the user is not authorized to see (potentially sensitive data or memory layout). No public exploit code has been identified, and exploitation requires existing local access, so this would most plausibly be used as a post-compromise or insider step rather than an initial intrusion vector.