Windows TSF EUVD-2026-99507

Requires the attacker to already have local, low-privileged code-execution on the target Windows system (PR:L, AV:L) - there is no remote or network-reachable vector. Exploitation involves triggering a use-after-free in the Windows Text Services Framework (the input-method/text-input subsystem loaded in interactive Windows sessions); no user interaction is needed (UI:N) and attack complexity is low (AC:L). The primary limiting factor is the prerequisite valid local foothold or authenticated session: it cannot be exploited by an unauthenticated remote attacker and is relevant chiefly as a post-compromise SYSTEM escalation step, with greatest exposure on multi-user, RDP, or terminal-server hosts. Affected configurations are default installations across supported Windows 10/11 and Windows Server 2012 through 2025 builds below the patched versions listed in EUVD.

This is a credible but not emergency-tier priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N) describes a local privilege-escalation flaw: the attacker must already be able to execute code on the host with low privileges, so this is a post-compromise escalation primitive rather than an initial-access or remotely-reachable vulnerability. Complexity is low and no user interaction is required, meaning that once a foothold exists the condition is reliably reachable, and the high C/I/A impact (7.8 base) reflects full SYSTEM-level compromise typical of a successful Windows EoP. On exploitation signals: the input provides no CISA KEV listing and no POC indicator, so there is no public exploit identified at time of analysis and no evidence of active exploitation - this is not a zero-day based on available data. No EPSS score was supplied, so widespread-exploitation probability cannot be quantified from the input. The absence of exploitation evidence should be weighed against the fact that Windows Text Services Framework use-after-free bugs are historically attractive to attackers and malware as a reliable local escalation step after phishing or browser exploitation, and that a vendor patch already exists (routine Microsoft Patch Tuesday hardening). Net: patch on normal-to-expedited cadence for endpoints and multi-user/terminal-server hosts; it is not a drop-everything internet-facing emergency because exploitation requires prior local access. One data note: the input Tags include 'Denial Of Service', which is inconsistent with a description and CVSS that both indicate privilege elevation with high integrity/confidentiality impact - treat the EoP framing (confirmed by the description) as authoritative over the DoS tag.

An attacker who has already gained low-privileged code execution on a Windows host - for example via a phishing payload or a browser/application exploit - runs a crafted program that manipulates the Text Services Framework to trigger the use-after-free, corrupting kernel/service memory to execute code at higher privilege and obtain SYSTEM. Because the CVSS vector is local with low complexity and no user interaction, exploitation is reliable once that initial foothold exists. No public exploit code is identified at time of analysis.