Windows WebDAV EUVD-2026-99537

Requires the WebDAV component on Windows and an attacker who already has local access with low-privilege authenticated credentials (PR:L) on the target host - this is not remotely exploitable (AV:L). Exploitation is further limited by high attack complexity (AC:H), consistent with needing to control heap layout or win a timing condition to reliably trigger the CWE-122 heap overflow, so success is probabilistic rather than guaranteed. The primary limiting factors defenders can rely on are: the attacker must already be on the box with valid credentials, no network-facing exploitation path is indicated, and unpatched builds below the fixed versions listed in EUVD (e.g., Windows 11 24H2 below 10.0.26100.9711, Server 2025 below 10.0.26100.33650) must be present.

This is a moderate-priority local privilege escalation flaw rather than a critical remotely-exploitable issue. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) is internally consistent with the description's claim of local privilege elevation by an authorized attacker: the attacker must already have local access and valid low-level credentials (PR:L), and exploitation is gated by high attack complexity (AC:H), which typically reflects the non-deterministic nature of winning a heap-overflow condition (e.g., grooming the heap or a timing/race window). Impact is high across confidentiality, integrity, and availability because successful exploitation yields elevated (likely SYSTEM-level) privileges. No EPSS score was provided, so exploitation probability cannot be quantified. The CVE is NOT in CISA KEV and no public POC is referenced, so there is no evidence of active exploitation. The 7.0 score is driven almost entirely by the high impact triad, while the local vector, required authentication, and high complexity substantially limit real-world exploitability - making this a classic 'patch in normal cycle' rather than 'emergency' item for most environments, with higher urgency on multi-user or shared Windows hosts where low-privileged users are untrusted. Note: the reporter is Microsoft's own security team (secure@microsoft.com) and all affected products are Microsoft Windows, which is consistent with a vendor-coordinated Patch Tuesday disclosure.

A low-privileged but authenticated user already present on a Windows system (for example, a standard domain user on a shared server or an attacker who gained a foothold via another vector) triggers a crafted operation against the WebDAV client/service component to overflow a heap buffer. By carefully grooming the heap and winning the required timing/complexity conditions, the attacker corrupts memory to execute code in a higher-privilege context, escalating to SYSTEM. No public exploit code is identified at time of analysis, and the high attack complexity means exploitation is not guaranteed on each attempt.