Windows RPC Runtime EUVD-2026-99299

The attacker must already have local, authenticated access with at least low privileges (PR:L) - i.e., the ability to execute code as a standard user on the target Windows 11 host - in order to invoke the vulnerable RPC Runtime code path and trigger the heap overflow. No special non-default configuration is required since RPC Runtime is a core, always-present Windows component, and no user interaction is needed (UI:N). The primary limiting factor is the local attack vector (AV:L): the flaw cannot be reached remotely over the network and requires prior foothold on the machine, making it an escalation primitive rather than an initial-access vector. Exploitation is limited to the enumerated unpatched Windows 11 builds (23H2 <10.0.22631.7582, 24H2 <10.0.26100.9445, 25H2 <10.0.26200.9445, 26H1 <10.0.28000.2954).

This is a genuine patch-priority issue but not an emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N) describes a local, low-complexity, low-privilege vulnerability requiring no user interaction, with total impact (C:H/I:H/A:H) consistent with a privilege-escalation flaw in a Windows kernel-adjacent component. Signals are internally consistent and point toward moderate real-world urgency: SSVC reports Exploitation=none and Automatable=no, meaning CISA's framework currently sees no active or reliably scriptable exploitation, which aligns with the absence of a KEV listing and the absence of any public POC in the provided data. SSVC Technical Impact=total corroborates the CVSS C/I/A=High ratings. No EPSS score was provided, so exploitation probability cannot be quantified here. There is no conflict between signals - the picture is a high-severity local EoP that is patched by the vendor but not yet observed being exploited. Because RPC Runtime is a universal Windows component, patch urgency is driven by prevalence and the role of such flaws as a post-compromise escalation step (e.g., chained after initial access or phishing), rather than by evidence of mass exploitation.

An attacker who already has the ability to run code as a low-privileged local user (e.g., after phishing or via a standard user account) invokes the RPC Runtime with crafted input that triggers a heap-based buffer overflow, corrupting memory to execute code at SYSTEM. No user interaction and no network access is needed. No public exploit code was identified in the provided data, so this remains a theoretical-but-credible local escalation path.