Microsoft IMAPI EUVD-2026-99437

Exploitation requires the attacker to already possess local, authenticated access to the Windows host at a low privilege level (PR:L) and the ability to pass attacker-controlled data to the Microsoft Internet Messaging API (inetcomm/IMAPI) to trigger the heap overflow; no user interaction is needed (UI:N). Limiting factors: the vector is strictly local (AV:L) - there is no remote or network-reachable path in the scored vector - so a prior foothold or valid credentials on the machine is a hard prerequisite, and scope is unchanged (S:U), confining impact to the vulnerable component's context rather than crossing a trust boundary. The affected component ships by default across supported Windows 10, Windows 11 (21H2 through 26H2), and Windows Server 2012 through 2025 builds, so no special non-default configuration is indicated; patch to the fixed build listed in the MSRC advisory removes the condition.

This is a credible but not emergency-tier priority. The CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) describes a local, low-complexity vulnerability requiring low-level (authenticated/standard user) privileges and no user interaction, yielding total confidentiality, integrity, and availability impact - consistent with a classic local privilege-escalation or code-execution-in-context primitive via heap corruption (CWE-122). CISA SSVC reinforces a measured view: Exploitation is rated 'none' (no observed or public exploitation), Automatable is 'no' (the local attack vector cannot be sprayed at scale), yet Technical Impact is 'total' (full compromise of the affected component once triggered). No EPSS score was supplied, so quantitative exploitation probability cannot be cited. There is no CISA KEV listing and no indication of public POC code in the provided intelligence, so per precision rules this is 'no public exploit identified at time of analysis.' The signals are internally consistent - a high technical-impact bug that is gated behind local access and authentication, lowering real-world urgency relative to a remote unauthenticated flaw. The practical priority is driven almost entirely by prevalence: the affected product is the Windows platform itself, so the enormous install base, not exploitability, is the main reason to patch promptly. Missing data to note: no EPSS, no KEV, and no confirmed POC status - absence of these is not evidence of safety, but none currently elevate this above standard Patch-Tuesday urgency.

A local attacker who already has a standard (low-privilege) authenticated session on a Windows host supplies crafted input to the Internet Messaging API, triggering a heap-based buffer overflow that corrupts adjacent heap structures to hijack control flow and execute code in the targeted component's context. Because the CVSS scope is unchanged (S:U) and the vector is local (AV:L), this is realistically used as a privilege-escalation or post-compromise step rather than an initial remote breach. No public exploit code is identified at time of analysis, and SSVC rates current exploitation as none.