Windows Search EUVD-2026-99590

Requires the attacker to already hold valid low-privileged local credentials on the target host (PR:L, AV:L) and to interact with the Windows Search Component to reach the vulnerable shared resource. Exploitation is limited by high attack complexity (AC:H): the attacker must reliably win a narrow race-condition timing window on the improperly synchronized resource, which typically demands many repeated attempts and favorable scheduling conditions. No remote or unauthenticated path exists, and no special non-default Search configuration is indicated in the available data - the component is present by default in all supported Windows editions.

This is a credible but not top-tier priority. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0 HIGH) describes a local elevation-of-privilege flaw requiring an already-authenticated low-privileged user and a high-complexity race window, yet yielding full confidentiality, integrity, and availability impact (typically SYSTEM). No EPSS score, no CISA KEV listing, and no public POC were provided, so exploitation status is 'no public exploit identified at time of analysis.' The AC:H metric is significant: winning a race condition reliably is non-trivial, which tempers real-world weaponization despite the complete impact triple. No SSVC decision data was supplied. The key tension is between the CRITICAL-sounding C:H/I:H/A:H and the practical barriers (local access + hard-to-win race) - treat this as a privilege-escalation building block for post-compromise chains rather than an internet-facing emergency. The 'Information Disclosure' tag conflicts with the description and CWE-362, which describe privilege elevation; verify categorization with the MSRC advisory.

An attacker who already has a standard user foothold on a Windows host (via phishing, stolen credentials, or a prior low-privilege compromise) repeatedly triggers the Windows Search Component to hit a narrow timing window in an improperly synchronized shared resource. By winning the race, they manipulate the shared state to execute code or gain access at SYSTEM level, escalating from limited user to full host control. No public exploit code was identified, and the high attack complexity means exploitation requires repeated, timing-sensitive attempts.