Windows Shell EUVD-2026-99365

The description and CVSS vector (AV:N/AC:L/PR:N/UI:N) indicate no special conditions - remote unauthenticated code execution is possible against affected default installations of Windows (client editions 10 1607 through 11 26H2, and Windows Server 2012 through 2025, per the EUVD affected-version list). The description does not name a specific enabled feature, protocol handler, or non-default configuration as a prerequisite, and it specifies no required user interaction or authentication, so the primary limiting factor is simply patch status: hosts updated to the fixed build for their edition (e.g., Windows 11 24H2 ≥10.0.26100.9711, Server 2025 ≥10.0.26100.33650) are not exploitable. Network reachability of the vulnerable Windows Shell code path is the practical precondition; because the exact triggering surface is not specified in the input, defenders should verify with Microsoft's MSRC advisory whether exposure depends on a particular shell/file-handling interaction.

This is a high-priority vulnerability by most signals, though one key signal tempers the urgency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes the worst-case profile: remote, network-reachable, low attack complexity, no privileges, and no user interaction, yielding total CIA impact (C:H/I:H/A:H) and a 9.8 base score - consistent with CWE-122 heap-based buffer overflow leading to remote code execution. The CISA SSVC framework reinforces part of this, flagging the technical impact as 'total' and the flaw as 'automatable: yes' (meaning it is amenable to reliable, scalable exploitation). However, SSVC 'Exploitation: none' indicates no observed or public exploitation at the time of analysis, and the input contains NO EPSS score, NO CISA KEV listing, and NO evidence of public POC code - so the exploitation-probability dimension is unmeasured rather than confirmed low. The net picture is a critical-severity, highly exploitable-in-principle RCE that is not yet known to be exploited; the combination of 'automatable: yes' plus total impact plus unauthenticated network vector means this should be patched urgently because weaponization would likely be rapid and widespread, even though no active exploitation is currently evidenced.

A remote, unauthenticated attacker crafts malicious input that reaches the Windows Shell component and triggers a heap-based buffer overflow, corrupting heap memory to hijack control flow and execute arbitrary code in the context of the vulnerable process. Because the CVSS vector specifies AV:N/AC:L/PR:N/UI:N, no credentials or victim interaction are required under the worst-case profile. No public exploit code is identified at time of analysis, but SSVC rates the flaw as automatable with total technical impact, so reliable exploitation is plausible once the bug is understood.