Internet Explorer EUVD-2026-99425

Exploitation requires the attacker to already possess local, authenticated low-privileged access to the Windows host (PR:L, AV:L) and to trigger a use-after-free in the Internet Explorer/MSHTML engine that is present by default across the affected Windows 10, Windows 11 (21H2-26H2), and Windows Server 2019/2022/2025 builds listed in EUVD. No user interaction is needed (UI:N), but the high attack complexity (AC:H) means exploitation depends on winning a memory-timing/race condition and successful heap grooming to reclaim the freed object, which limits reliability. The principal limiting factors are the need for a prior local foothold and the non-trivial complexity, not any special non-default configuration.

Signals are consistent and point to a genuine but non-emergency local privilege-escalation issue rather than a mass-exploitation threat. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:C) describes a local attack requiring an already-authenticated low-privileged foothold and high attack complexity (characteristic of use-after-free race/heap-grooming conditions), yielding total C:H/I:H/A:H impact with a scope change - hence the 7.8 High base score. The CISA SSVC decision framework agrees this is not urgent: Exploitation=none, Automatable=no, while Technical Impact=total matches the full compromise the CVSS impact metrics describe. There is no CISA KEV listing and no EPSS score was supplied in the input, and no public proof-of-concept is referenced, so there is currently no evidence of exploitation or exploit availability. The practical ceiling is that an attacker must already be able to run code locally as a standard user, and AC:H means reliable exploitation is non-trivial; this is a privilege-elevation primitive useful as a second stage after initial access, not a remote entry point. One inconsistency to note: the input Tags include 'Denial Of Service', but the description and CWE-416 describe privilege elevation via use-after-free - the DoS label appears to be a loosely-applied secondary effect of memory corruption rather than the primary impact.

An attacker who has already gained unprivileged code execution on a Windows host (e.g., via phishing or a compromised standard-user account) runs a crafted program that manipulates the Internet Explorer/MSHTML component to trigger a use-after-free on freed object memory. By grooming the heap and winning the timing window implied by the high attack complexity, they reuse the dangling reference to execute code at a higher privilege level, elevating to SYSTEM. No public exploit code is identified at time of analysis, so a working exploit would need to be developed.