Windows Search EUVD-2026-99185

Requires an authenticated local attacker with low privileges (PR:L, AV:L) already executing code on the target Windows host - this is a post-access local escalation, not remotely reachable. Exploitation is limited by high attack complexity (AC:H), consistent with winning a use-after-free race condition in the Windows Search Component that depends on precise timing and memory state and likely needs repeated attempts. No user interaction is required (UI:N). All supported Windows client and server builds below the patched versions are affected in default configurations; installing the Microsoft update removes the condition.

This is a moderate-priority local privilege escalation, not an emergency. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U) shows the key limiting factors: the attacker must already have local, low-privileged access (PR:L) and overcome high attack complexity (AC:H) - characteristic of a use-after-free race condition that is not reliably winnable. Impact, however, is total (C:H/I:H/A:H), consistent with CISA SSVC rating Technical Impact as 'total'. The signals are internally consistent and point AWAY from urgency: SSVC Exploitation is 'none' and Automatable is 'no', there is no CISA KEV listing, and no public exploit was identified. No EPSS score was provided in the input, so probabilistic exploitation likelihood could not be independently weighed. Net: a genuine but non-urgent fix - prioritize via the normal Patch Tuesday cycle rather than out-of-band, since the AC:H/PR:L gating plus absent exploitation evidence make mass or opportunistic exploitation unlikely, though it remains a useful component in a post-compromise local escalation chain.

An attacker who already holds a low-privileged foothold on a Windows host (e.g., via phishing or a compromised standard-user account) triggers a use-after-free in the Windows Search Component by racing memory operations, then reclaims the freed object to gain code execution in a higher-privileged context. Because attack complexity is high (AC:H), the race likely requires multiple attempts and precise timing. No public exploit identified at time of analysis.