EUVD-2026-99302
GHSA-pjpj-74r5-gxv8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged local access
-
DeliveryInvoke vulnerable Windows Search operation
-
ExploitTrigger use-after-free and groom freed object
-
ExecutionHijack reused allocation to execute code
-
ImpactElevate to SYSTEM/higher privileges
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a local, authenticated foothold on an affected Windows system - the attacker must already be able to execute code as a low-privileged user (PR:L, AV:L); there is no remote or unauthenticated path. The use-after-free further requires winning a high-complexity condition (AC:H), i.e., triggering the free-then-reuse race in the Windows Search Component with the right memory state, which limits reliability. No end-user interaction is needed (UI:N). Exploitation is limited to unpatched builds below the fixed versions listed in EUVD (e.g., Windows 11 24H2 below 10.0.26100.9711, Server 2025 below 10.0.26100.33650, Server 2016/Win10 1607 below 10.0.14393.9612); patched systems are not affected. |
| Impact | This is a genuine but second-tier priority. The CVSS 3.1 vector (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0 High) describes a local-only privilege escalation: the attacker must already have local, authenticated access (PR:L) and must win a high-complexity condition (AC:H), which for a CWE-416 use-after-free typically means hitting a memory-corruption race or specific allocation state. All three impact metrics are High, consistent with the SSVC 'Technical Impact: total' rating - successful exploitation yields full control of the component. However, the de-prioritizing signals dominate: SSVC reports 'Exploitation: none' and 'Automatable: no', and there is no CISA KEV listing, no public exploit code, and no EPSS score supplied. These align with the AC:H rating - this is not a point-and-click, mass-exploitable flaw. One discrepancy to note: the input Tags include 'Denial Of Service', yet the description and CVSS (C:H/I:H/A:H) frame this as an elevation-of-privilege/total-impact issue, not a pure availability/DoS bug; treat the DoS tag with skepticism. Bottom line: a patched, locally-exploitable EoP with no observed exploitation - important for patch hygiene (especially on multi-user/shared Windows hosts) but not an emergency relative to remote unauthenticated criticals. |
| Exploit ScenarioDerived | An attacker who already has a low-privileged local foothold on a Windows host (e.g., a standard user account or code running in a restricted context) triggers a specific operation in the Windows Search Component that frees an object still referenced elsewhere, then grooms memory to reuse the freed allocation and hijack execution to run code at elevated privilege. Because CVSS is AC:H, the attacker must reliably win a timing/allocation condition, so exploitation is non-trivial. No public proof-of-concept exploit has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Local privilege escalation in the Microsoft Windows Search Component allows an attacker who already holds a low-privileged foothold on an affected Windows host to elevate to a higher-integrity context, with high impact to confidentiality, integrity, and availability (CVSS 3.1 base 7.0). Exploitation is constrained: the CVSS vector (AV:L/AC:H/PR:L/UI:N/S:U) confirms the attack is local and requires an authenticated low-privileged user, and the use-after-free must be won under a high-complexity memory/race condition, reducing reliability. All supported Windows client and server builds below their respective fixed revisions are affected, Microsoft has released patches, and no public exploit code was identified at time of analysis and CISA's SSVC assessment records exploitation as none with the vulnerability not automatable.
RemediationAI
Vendor-released patch: Microsoft has published fixes for this CVE, and each affected branch must be brought to its fixed revision - Windows 11 24H2 to 10.0.26100.9711, Windows 11 25H2 to 10.0.26200.9711, Windows 11 26H1 to 10.0.28000.3231, Windows 11 26H2 to 10.0.26300.9711, Windows 11 23H2 to 10.0.22631.7652, Windows 10 1607 and Windows Server 2016 (including Server Core) to 10.0.14393.9612, Windows 10 1809 and Windows Server 2019 (including Server Core) to 10.0.17763.9376, Windows 10 21H2/22H2 to 10.0.19044.7807, Windows Server 2022 to 10.0.20348.5761, Windows Server 2025 (including Server Core) to 10.0.26100.33650, Windows Server 2012 to 6.2.9200.26434, and Windows Server 2012 R2 to 6.3.9600.23470; deployment should follow https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83575 and be prioritised on multi-user hosts (RDP session hosts, terminal servers, VDI, and jump boxes) where an untrusted local user can race the trigger, while low-value single-user workstations can follow the normal monthly cadence. Because exploitation requires an existing local authenticated foothold with a high-complexity trigger and no public exploit code was identified, patching is the decisive control and there is no meaningful network-level mitigation. If patching must be deferred, the practical compensating control is to reduce the local-user population and privilege surface on the host - remove unnecessary interactive accounts, restrict who may open an RDP/interactive session, and monitor the Windows Search service account for repeated crashes or unexpected child-process creation - accepting that this only raises the cost of obtaining the required foothold rather than removing the flaw. Stopping or disabling the Windows Search service (WSearch) and its indexer removes the vulnerable surface but breaks search, indexing-dependent features, and Outlook/File Explorer search on that host, so it is suitable only for hardened server roles that do not rely on indexing; likewise, aggressive restrictions on local logon or the application of exploit protection mitigations such as arbitrary code guard to the search process may cause functional regressions and require pilot testing. On hosts already patched to the revisions above, exploitation of this CVE is not possible and no further action is required.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 20 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-416, Use After Free, in the Windows Search Component - the indexing/search subsystem that maintains the content index and exposes it to query and protocol handlers. In this class of defect, a heap object is released while a stale reference to it is still reachable; a subsequent operation dereferences that freed memory, letting an attacker who can influence allocation and reuse (heap grooming) redirect execution or corrupt adjacent structures in the context of the search service, which runs with elevated privileges. The CVSS vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H indicates the primitive is only reachable from a local session with an authenticated low-privileged token, that no user interaction is required, that the scope of impact stays within the same security authority, and that the attacker must solve a high-complexity precondition - effectively winning a race between the free and the reuse with the correct memory layout - before the write is controllable. The associated tags (Use After Free, Memory Corruption, Denial Of Service) are consistent with a fault that can both crash the search component (availability loss until the service/library restarts) and, when reliably shaped, yield privilege escalation. CPE-level product data from the EUVD advisory places affected binaries across the Windows 10, Windows 11, Windows Server 2012/2012 R2/2016/2019/2022/2025 families, meaning the same vulnerable search code is shipped in both client and Server Core SKUs on the servicing branches enumerated below.
Know when Windows gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Local authorized attacker gives AV:L/PR:L; use-after-free race yields AC:H; no UI needed; full component control maps to C:H/I:H/A:H with unchanged scope.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.
Executive ViewAI
A local privilege-escalation flaw in the Microsoft Windows Search Component affects all supported Windows client and server builds that have not yet been updated to Microsoft's fixed revisions. An attacker would already need an authenticated, low-privileged foothold on the host before exploiting this issue, so the practical risk is to organizations whose endpoints and servers could be used as a pivot point by an intruder or malicious insider rather than to the general external attack surface. Given the high-complexity race condition required to succeed, this is best treated as a patch-hygiene item that closes a potential escalation path inside an already-compromised environment.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Twonky Server 8.5.2 uses hard-coded cryptographic keys for encrypting the administrator password. Combined with the cred
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Exploit-DB