Microsoft XML EUVD-2026-99433

Exploitation requires the vulnerable Microsoft XML (MSXML) component to parse attacker-supplied XML content; the flaw is a use-after-free (CWE-416) in that parser rather than a condition of a specific optional feature or non-default setting. Per the CVSS vector (PR:N), no authentication is required and the attacker is unauthenticated. The primary LIMITING factor is HIGH attack complexity (AC:H): reliable exploitation of a use-after-free typically demands precise heap grooming or race-condition timing, reducing the chance of trivial, repeatable exploitation. A second practical limiter to verify is the delivery/trigger path - MSXML RCEs generally require a victim to open or render malicious XML (via a document, web page, or an application that passes untrusted XML to MSXML), which in practice often implies user interaction despite the vector's UI:N. Affected systems span supported Windows client and server editions (including Server Core) below the patched build numbers listed in EUVD-2026-99433.

Signals are mixed and point to a serious-but-not-emergency priority. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, base 8.1) describes a remote, unauthenticated, no-user-interaction path to full compromise (C:H/I:H/A:H), which is severe - but the HIGH attack complexity (AC:H) is significant and consistent with a use-after-free (CWE-416) that depends on winning a race or on precise heap state, making reliable exploitation non-trivial. CISA's SSVC framework reinforces a lower urgency: Exploitation=none, Automatable=no, Technical Impact=total - i.e. full impact if exploited, but no observed exploitation and not amenable to mass/automated attack. There is no CISA KEV listing and no POC indicated in the input, so exploitation status is 'no public exploit identified at time of analysis.' No EPSS score was provided, so probabilistic exploitation likelihood cannot be quantified here. A notable conflict to verify: the vector asserts UI:N, yet use-after-free flaws in Microsoft XML (MSXML) parsers are historically triggered when a victim opens or renders attacker-supplied XML (document, web page, or application input), which usually implies some user interaction - verify the true trigger path with Microsoft's MSRC advisory before treating this as a fully interaction-free network RCE. Net: a genuine high-severity patch-now item given MSXML's ubiquity, but the AC:H and SSVC 'none/no' signals argue it is not yet a drop-everything, actively-exploited emergency.

A remote attacker delivers specially crafted XML content that is parsed by a vulnerable Microsoft XML (MSXML) component on a target Windows system, triggering a use-after-free during parsing. By grooming the heap so the freed object is reallocated with attacker-controlled data, the attacker gains control of execution and runs code in the context of the parsing process. No public exploit code is identified at time of analysis, and the HIGH attack complexity means successful exploitation likely requires reliable heap manipulation or race-condition timing.