Windows PowerShell EUVD-2026-99303

Exploitation requires a network-reachable code path into the vulnerable Windows PowerShell parsing/allocation logic - in practice an exposed PowerShell remoting/WinRM or a service that feeds attacker-controlled data into that path. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, privileges, or user interaction are needed, and SSVC marks it Automatable, so default reachable configurations are at risk. The principal limiting factor is network exposure of the vulnerable interface: environments that do not expose PowerShell remoting externally and that restrict WinRM to trusted hosts/segmented networks materially reduce reachability. Systems patched to the fixed builds listed in the EUVD data (e.g., Windows 11 24H2 >=10.0.26100.9711, Server 2025 >=10.0.26100.33650) are not affected.

This is a genuine high-priority vulnerability, not an inflated CVSS score. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes remote, low-complexity, unauthenticated code execution with total compromise of confidentiality, integrity, and availability (C:H/I:H/A:H), yielding a 9.8 base. CISA's SSVC framework reinforces this: Technical Impact is 'total' and the flaw is 'Automatable: yes', meaning it is amenable to reliable, scripted mass exploitation - a strong worm/mass-scan indicator. The one tempering signal is SSVC Exploitation status 'none', meaning no exploitation has been observed; consistent with this, the input lists no CISA KEV entry and no public POC, so there is no public exploit identified at time of analysis. No EPSS score was provided, so probabilistic exploitation likelihood cannot be factored in - STATE EXPLICITLY: EPSS is MISSING from the input. One data conflict to flag: the CWE is CWE-122 (heap-based buffer overflow) and the tags say 'Heap Overflow', yet the description attributes root cause to an integer underflow (normally CWE-191); these are reconcilable (an integer underflow can produce an undersized allocation leading to a heap overflow), but the precise mechanism should be verified against Microsoft's advisory. Net: treat as urgent patch priority given ubiquitous deployment, network reach, no authentication, and high automatability, while noting no confirmed in-the-wild exploitation yet.

A remote, unauthenticated attacker sends specially crafted data to a Windows system where the vulnerable PowerShell parsing/deserialization code path is reachable over the network (e.g., via a PowerShell remoting/WinRM-exposed or service-fronted interface), triggering an integer underflow that leads to a heap buffer overflow and arbitrary code execution. Because CVSS is AC:L/PR:N/UI:N and SSVC marks it Automatable, the attack requires no privileges or user interaction and could be scripted for mass exploitation. No public proof-of-concept or active exploitation is identified in the provided data at time of analysis.