Microsoft Windows EUVD-2026-99386

Exploitation requires the attacker to already have local, interactive access to the host with valid low-privileged (non-admin) credentials, matching CVSS AV:L and PR:L - this is a post-compromise escalation primitive, not a remote entry point. No user interaction is needed (UI:N) and attack complexity is low (AC:L), so once a standard-user foothold exists, triggering the untrusted pointer dereference in the COM+ Event System Service requires no special non-default configuration. The principal limiting factors are therefore the mandatory pre-existing local authenticated access and the absence of any remote vector; defenders relying on strong initial-access controls and least-privilege user accounts materially reduce realistic risk. Affected systems are unpatched Windows builds below the fixed versions listed in the EUVD data (e.g., Windows 11 24H2 below 10.0.26100.9711, Windows Server 2025 below 10.0.26100.33650, Server 2016 below 10.0.14393.9612).

This is a credible but moderate-priority local privilege escalation. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N) confirms the attacker must already have local access and valid (low-privilege) credentials on the host - this is not a remotely exploitable flaw, which caps its urgency relative to network-facing bugs of the same 7.8 score. The signals are internally consistent and point AWAY from imminent mass exploitation: CISA SSVC lists Exploitation as 'none' and Automatable as 'no', there is no CISA KEV listing and no public exploit code identified, so the status is reconnaissance/weaponization-free at this time. The one signal pulling the other way is SSVC Technical Impact 'total', matching the CVSS C:H/I:H/A:H full-SYSTEM compromise outcome - meaning that IF an attacker does chain this (e.g., after a phishing foothold), the payoff is complete control of the affected host. No EPSS score was provided in the input, so probabilistic exploitation likelihood could not be weighed. Net: a legitimate patch-in-normal-cycle item for defenders, valuable as a post-compromise escalation primitive but not a drop-everything emergency, given low complexity but the hard requirement of pre-existing local authenticated access.

An attacker who has already gained a foothold as a standard (low-privilege) user - for example via phishing or a separate initial-access bug - runs a crafted local program that supplies an untrusted pointer to the COM+ Event System Service, causing it to dereference attacker-controlled memory and execute code in the service's privileged context. This yields full SYSTEM-level control of the machine. No public proof-of-concept or exploit code was identified in the provided data, and CVSS AC:L indicates the technical exploitation itself is low-complexity once local access exists.