Windows Search EUVD-2026-99438

Requires the attacker to already have a local, authenticated foothold on the target (PR:L in the CVSS vector), i.e. the ability to run code or hold a valid interactive/session context on a Windows host where the Search Component is present (default on Windows 10/11 and Windows Server 2012-2025 within the listed build ranges). No user interaction by a victim is needed (UI:N) and no network path exists (AV:L), so exploitation is confined to local escalation. Limiting factors: the attacker must supply crafted input that reaches the vulnerable Search code path and successfully perform heap grooming for reliable control (consistent with SSVC Automatable=no), and the target must be unpatched - Microsoft has shipped fixed builds (e.g. Windows 11 24H2 >=10.0.26100.9711, Server 2022 >=10.0.20348.5761).

This is a credible but moderate-priority local privilege-escalation flaw, not a remote-exploitation emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N) confirms it requires local access and existing low-level privileges (an authenticated/authorized user), which caps the base score at 7.8 (High) despite total C:H/I:H/A:H impact - consistent with heap corruption in a system component (CWE-122) yielding SYSTEM-level code execution. CISA's SSVC framework reinforces a measured posture: Exploitation=none (no observed exploitation), Automatable=no (requires local foothold and likely non-trivial heap grooming, aligning with the CWE-122 class), but Technical Impact=total (full compromise once triggered). No EPSS score, KEV listing, or POC was provided, so exploitation likelihood signals are absent rather than low - this means the SSVC 'none' is the only exploitation-maturity data point and should not be read as a guarantee the technique is hard. The signals are internally consistent (local-only vector matches 'not automatable' and 'exploitation none'); the practical risk is as a post-compromise escalation primitive on the enormous Windows install base, making it important for patch prioritization on multi-user and server systems but not a drop-everything remote threat.

A low-privileged but authenticated local user (or malware already running in a limited user context) interacts with the Windows Search Component in a way that supplies crafted input, triggering a heap-based buffer overflow. By grooming the heap and controlling the overflow, the attacker corrupts memory to execute arbitrary code at SYSTEM privilege, completing local privilege escalation. No public exploit code was identified in the provided data, and exploitation requires the attacker to already have local code-execution or a valid session.