Windows Search EUVD-2026-99436

Exploitation requires the attacker to already have local, low-privileged authenticated access to the target Windows host (PR:L, AV:L) - remote or unauthenticated exploitation is not possible. The flaw resides in the Windows Search component, which is present by default across the listed Windows 10/11 and Windows Server editions, so no non-default feature toggle is indicated by the available data. The key limiting factor is HIGH attack complexity (AC:H): the attacker must satisfy specific memory-layout or timing conditions to reliably corrupt the heap, so exploitation is not guaranteed on each attempt. No user interaction is required (UI:N).

This is a genuine but moderate-priority local privilege escalation. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U) describes a flaw requiring local access and existing low-privilege authentication, with HIGH attack complexity - meaning exploitation depends on winning a race or satisfying memory-layout conditions that are not reliably reproducible, which materially lowers real-world weaponization likelihood. Impact is high across confidentiality, integrity, and availability (C:H/I:H/A:H), consistent with code execution at elevated privilege. Exploitation status is 'no public exploit identified at time of analysis' - this CVE is NOT in CISA KEV and no POC is referenced. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified; this is a data gap, not a low score. No SSVC decision data was supplied. The signals are internally consistent (local vector, authorized attacker, EoP classification all agree), so there is no contradiction between description and CVSS. Net: a real issue to patch in normal Patch-Tuesday cadence, not an emergency - the AC:H and PR:L constraints plus absence of exploitation evidence argue against immediate out-of-band action, though its ubiquity on Windows raises aggregate exposure.

A low-privileged authenticated user (or malware already running in a standard user context) triggers a crafted operation against the Windows Search component to overflow a heap buffer and corrupt adjacent memory, gaining SYSTEM-level privileges. No public exploit code is identified at time of analysis, and the high attack complexity (AC:H) means the attacker must satisfy specific heap-state or timing conditions for reliable exploitation.