Windows Hello EUVD-2026-99351

Exploitation requires the attacker to already possess valid low-privilege local access to the system (PR:L) and to exercise the Windows Hello authentication/biometric component code path on an unpatched build within the affected ranges (e.g., Windows 11 24H2 below 10.0.26100.9711, Windows 10 22H2 below 10.0.19044.7807, Windows Server 2022 below 10.0.20348.5761). The use-after-free is a timing-dependent memory-corruption flaw: successful exploitation means winning a race to reallocate the freed object, which is why CVSS rates attack complexity High (AC:H) and CISA marks it non-automatable. No user interaction is needed (UI:N), and no network vector exists (AV:L), so a remote or unauthenticated attacker cannot reach it directly - these are the principal factors limiting real-world exploitability.

This is a genuine but second-tier priority. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0 HIGH) describes a local, authenticated elevation-of-privilege flaw with high attack complexity, not a remotely reachable issue. All exploitation signals point toward low immediate urgency: there is no CISA KEV listing and no public exploit identified, and CISA's SSVC decision framework records Exploitation=none and Automatable=no, which is fully consistent with the AC:H (hard-to-win race/use-after-free timing) and AV:L (local access required) metrics. The one signal pulling the other way is SSVC Technical Impact=total, matching C:H/I:H/A:H - if successfully exploited, the attacker gains complete control of the affected component. No EPSS score was supplied, so probabilistic exploitation likelihood cannot be quantified; this is a data gap, not evidence of low risk. The signals are therefore internally consistent rather than conflicting: high potential impact but meaningful barriers (local access, valid low-privilege credentials, and a difficult race condition). Net assessment: a real patch-soon item for privilege-escalation hardening and post-compromise defense, but not a drop-everything emergency absent evidence of active exploitation.

An attacker who already has a low-privileged interactive or local session on a Windows endpoint (for example via phishing, stolen credentials, or an earlier foothold) targets the Windows Hello authentication component and repeatedly triggers a use-after-free condition, racing to reallocate the freed object with attacker-controlled data. On a successful race they corrupt memory to execute code at elevated privilege, moving from a standard user to SYSTEM-level control. No public exploit code has been identified, and the high attack complexity means reliable exploitation requires winning a timing-sensitive race.