Windows Geotag Broker EUVD-2026-99305

Exploitation requires the attacker to already have local, authenticated access to the target host as a low-privileged user (CVSS PR:L, AV:L) and the ability to interact with the Windows Geotag Broker component; no user interaction is needed (UI:N) and attack complexity is low (AC:L). Limiting factors: there is no remote or network-facing path (AV:L rules out remote unauthenticated exploitation), so an attacker must first obtain code execution or an interactive session on the machine. Risk is concentrated on multi-user systems - terminal/RDP servers, shared workstations, and hosts where untrusted users can run code - and is lower on single-user endpoints with no untrusted local principals. Affected systems are unpatched Windows builds below the fixed versions listed in the EUVD data (e.g. Windows 11 24H2 below 10.0.26100.9711, Server 2022 below 10.0.20348.5761).

This is a genuine patch-priority issue for Windows estates, though not an emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8 HIGH) describes a local, low-complexity privilege-escalation requiring an already-authenticated low-privileged user - not a remotely exploitable flaw. No EPSS score was provided, so statistical exploitation probability cannot be stated. KEV status is not indicated in the input (no CISA KEV listing provided) and no POC was reported, so per precision rules this is 'no public exploit identified at time of analysis.' There is no SSVC decision data supplied. The signals are internally consistent: a local-only, authenticated EoP with full CIA impact is a classic second-stage vulnerability used after an initial foothold, not a mass-exploitation vector. Treat it as a standard Patch-Tuesday-grade local EoP: important for servers and multi-user/RDP hosts where untrusted users can execute code, lower urgency on single-user endpoints. One data-quality caveat: the 'Authentication Bypass' tag conflicts with CWE-862 (Missing Authorization) and the 'elevate privileges' description - this is an authorization/access-control privilege-escalation issue, not an authentication bypass, so do not treat it as a pre-auth vulnerability.

A low-privileged but authenticated local user (or malware already running in a standard-user context) interacts with the Windows Geotag Broker service, which fails to properly enforce access control, and abuses it to run code or operations with elevated (SYSTEM-level) privileges. No public exploit code was identified at the time of analysis, and user interaction is not required (UI:N). Because the attack vector is local (AV:L) with low complexity (AC:L), it is a reliable post-compromise escalation step rather than an initial access technique.