PCI Bus Driver EUVD-2026-99576

Exploitation requires the attacker to already possess local, authenticated low-privileged access to the target Windows host (CVSS AV:L, PR:L) and the ability to execute code that interacts with the kernel-mode PCI Bus Driver (pci.sys), which is loaded by default on all Windows systems - so no non-default configuration or special feature toggle is needed. No user interaction is required (UI:N). The principal limiting factors are the need for a pre-existing local foothold and valid (even unprivileged) credentials or session; the flaw is not remotely reachable over the network and, per CISA SSVC, is not automatable, which constrains it to targeted post-compromise privilege escalation. Affected builds span Windows 10 (1809/21H2/22H2), Windows 11 (23H2/24H2/25H2/26H1/26H2), and Windows Server 2019/2022/2025 below the fixed build numbers listed in the EUVD record.

This is a credible, patch-now local privilege escalation rather than a hype-driven high-CVSS finding, but it is not a drop-everything emergency. The CVSS 3.1 base score of 7.8 reflects local attack vector (AV:L), low complexity (AC:L), low privileges required (PR:L), no user interaction (UI:N), and total CIA impact (C:H/I:H/A:H) with unchanged scope. CISA's SSVC decision points align with this nuance: Exploitation is rated 'none' (no observed or public exploitation), Automatable is 'no' (consistent with a local EoP that an attacker must chain after already obtaining code execution), yet Technical Impact is 'total' (full SYSTEM-level compromise of the affected host). The vulnerability is NOT in CISA KEV, and no POC is referenced, so there is no evidence of active exploitation - the correct posture is standard patch-cycle prioritization elevated by the fact that this is a kernel-mode driver flaw yielding total impact. No EPSS score was provided in the input, so probabilistic exploitation likelihood could not be weighed. The signals are internally consistent (local vector + authenticated + not-automatable all point to a post-compromise EoP), so there is no conflicting data to flag, only the missing EPSS value.

An attacker who already has a low-privileged foothold on a Windows host - for example via phishing, a malicious installer, or a compromised standard user account - runs a crafted program that sends malformed data to the PCI Bus Driver, triggering a heap-based buffer overflow in kernel memory to overwrite control structures and execute code as SYSTEM. No public exploit code is identified at time of analysis, and because the attack requires local access and is rated not-automatable by SSVC, it would be used as a deliberate privilege-escalation step within a broader intrusion rather than for mass exploitation.