Microsoft Account EUVD-2026-99384

Exploitation requires the attacker to already hold valid low-privileged (authenticated standard-user) local access to the target Windows system and the ability to execute code that reaches the vulnerable Microsoft Account component - CVSS AV:L/PR:L confirms local vector with low privileges required and no user interaction. There is no remote or network path and no POC is available, which limits exploitation to post-compromise escalation. Risk is highest on shared or multi-user Windows hosts where many principals can obtain an initial low-privilege foothold; single-user, fully-patched endpoints (fixed build numbers per the EUVD list, e.g. Windows 11 24H2 ≥10.0.26100.9711) are not affected.

Signals are consistent and point to a genuine but non-emergency priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8 High) describes a local privilege-escalation flaw requiring low existing privileges and no user interaction, with total confidentiality, integrity and availability impact - corroborated by the CISA SSVC assessment of Technical Impact = total. However, exploitation pressure is currently low: SSVC Exploitation = none, no CISA KEV listing, and no public exploit identified at time of analysis, while SSVC Automatable = no is expected for a local EoP that already presupposes a foothold. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified. The signals do not conflict: a high technical-impact local EoP with a vendor patch available but no observed exploitation. Net real-world risk is moderate - this is a reliable post-compromise escalation primitive (useful to malware and attackers who already have a standard user account) rather than a remotely wormable internet-facing threat, so it should be patched on a normal prioritized cycle, elevated on multi-user or shared Windows hosts.

An attacker who has already obtained low-privileged code execution on a Windows host (e.g., via phishing, a malicious local user, or a chained bug) invokes the vulnerable Microsoft Account component with crafted input that triggers a heap-based buffer overflow, corrupting heap memory to run attacker-controlled code at higher privilege. No public exploit code has been identified at time of analysis, and because the attack vector is local with no remote entry point, it serves as a second-stage escalation rather than an initial access vector.