Windows Push Notifications EUVD-2026-99403

Exploitation requires the attacker to already have local, authenticated access to the target host with at least low-level privileges (CVSS PR:L) - this is a privilege-escalation flaw, not a remote entry point, so it must be chained with a separate initial-access technique. No user interaction is required (UI:N) and attack complexity is low (AC:L), meaning that once a foothold exists, triggering the heap overflow in the Windows Push Notifications component is reliable. The primary limiting factor is the need for prior code execution on the machine; the flaw affects default Windows installations (client and server, including Server Core) with no special feature or non-default configuration called out in the description. Unpatched builds below the fixed versions listed in the EUVD advisory are required.

This is a credible but not emergency-level priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N) confirms a local, low-complexity attack requiring the attacker to already be authenticated with low privileges on the host - it is an elevation-of-privilege flaw, not a remotely reachable one. Impact is total (C:H/I:H/A:H), consistent with Microsoft's SSVC 'Technical Impact: total' rating, meaning successful exploitation yields full system compromise (typically SYSTEM). However, the risk signals are aligned toward lower urgency: SSVC 'Exploitation: none' and 'Automatable: no' indicate no observed exploitation and no reliable mass-automation path. There is no CISA KEV listing and no public exploit code identified, so there is no confirmed active exploitation. No EPSS score was provided in the input, so exploitation probability cannot be quantified. The signals are internally consistent - a high-impact local EoP that is valuable as a post-compromise step but does not enable initial remote access. Priority should be driven by the ubiquity of Windows rather than by exploitation evidence: patch on normal cadence, prioritizing multi-user and high-value hosts where a low-privilege foothold could be chained to SYSTEM.

An attacker who has already gained low-privileged code execution on a Windows host (e.g., via phishing, a compromised service account, or a standard user login) runs a crafted program that triggers the heap-based buffer overflow in the Windows Push Notifications component. By corrupting heap memory in a privileged context, the attacker escalates from their limited user rights to full SYSTEM privileges. No public exploit code has been identified at time of analysis, so weaponization would require independent development.