Windows Update EUVD-2026-99287

Requires the attacker to already possess local, low-privileged authenticated access to the target Windows host (PR:L, AV:L) in order to invoke the vulnerable Windows Update code path and trigger the heap overflow; no user interaction is needed (UI:N). The condition limiting exploitation is this prerequisite foothold - the flaw cannot be reached remotely or by an unauthenticated actor - making it a privilege-escalation primitive used after initial compromise rather than an initial-access vector. It affects default installations of the listed Windows 10, Windows 11 (21H2 through 26H2), and Windows Server 2016-2025 builds below the patched versions, with no special non-default configuration required.

This is a locally exploitable elevation-of-privilege flaw in Windows Update (CWE-122 heap-based buffer overflow). The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N) is internally consistent with the description: an 'authorized attacker' who already has low-privilege local access can trigger the overflow with low complexity and no user interaction to gain full confidentiality, integrity, and availability impact (C:H/I:H/A:H), consistent with SYSTEM-level privilege escalation. No EPSS score, KEV listing, or POC indicator was provided in the input, so there is no evidence of active exploitation or public exploit code at this time - the 7.8 severity is driven by impact, not by demonstrated real-world exploitation. Because this requires prior local, authenticated access (PR:L) it is not a remote or wormable threat; however, Windows Update is a core component present on every Windows host, and local-privilege-escalation bugs in it are high-value second-stage tools for attackers who already have a foothold. Treat as a solid patch-promptly priority for endpoint and server fleets, but not an emergency drop-everything issue absent any exploitation signal. No signals are directly conflicting; the main gap is the absence of EPSS/KEV/POC data to refine exploitation likelihood.

An attacker who has already gained low-privileged code execution on a Windows host (e.g., via phishing or a compromised standard user account) invokes the vulnerable Windows Update code path with crafted input that overflows a heap buffer. Exploiting the corruption, they execute code in the context of the privileged Windows Update service to escalate to SYSTEM. No public exploit code is identified at the time of analysis, and no user interaction is required (UI:N).