Windows Image Acquisition EUVD-2026-99548

Exploitation requires the attacker to already have local, authenticated access to the Windows host (PR:L) and the ability to interact with the Windows Image Acquisition (WIA) service that processes the externally-controlled format string. No user interaction is required (UI:N) and attack complexity is low (AC:L), but the flaw is NOT remotely reachable (AV:L) - it cannot be triggered across the network and must be launched from an existing local session. The primary limiting factor is this local-access prerequisite: the attacker needs a prior foothold (valid low-privilege credentials or code execution) before this bug can be used to reach SYSTEM. Affected systems are Windows 10 (21H2/22H2), Windows 11 (23H2/24H2/25H2/26H1/26H2), and Windows Server 2025 builds below the fixed versions listed in EUVD-2026-99548.

This is a credible but not top-tier priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8 HIGH) describes a local privilege escalation requiring the attacker to already hold low-level authenticated access to the host - it is NOT remotely exploitable. The high impact trio (C:H/I:H/A:H) reflects a jump to SYSTEM-level control, which is the typical and dangerous payoff of a Windows EoP. However, several high-signal indicators are absent: there is no CISA KEV listing, no POC availability indicated, and no EPSS score provided in the input, so there is no public exploit identified at time of analysis. The missing EPSS value prevents a quantitative exploitation-probability comparison; for a local-only EoP reported privately by the vendor (secure@microsoft.com), real-world mass exploitation probability is typically modest and dependent on chaining with an initial-access bug. One data note: the input Tags include 'Information Disclosure,' which conflicts with the description's clear 'elevate privileges locally' framing - treat this as an elevation-of-privilege issue, not primarily disclosure. Verdict: a real patch-worthy issue best prioritized as a second-stage/post-compromise hardening item rather than an emergency, absent evidence of active exploitation.

A local, already-authenticated attacker (for example, a standard user who gained a foothold via phishing or another bug) invokes the Windows Image Acquisition service with crafted input that is used as a format string, corrupting memory or leaking/writing controlled data. By exploiting this CWE-134 flaw, the attacker elevates from their limited account to SYSTEM-level privileges. No public exploit code is identified at time of analysis, and the low attack complexity (AC:L) means a working exploit, once developed, would be reliable.