Windows PowerShell EUVD-2026-99602

Requires the attacker to already have an authenticated, low-privilege local session on an affected Windows 11 (23H2/24H2/25H2/26H1/26H2) or Windows Server 2022/2025 host (AV:L, PR:L) and the ability to invoke the vulnerable PowerShell code path with attacker-controlled input that triggers the integer overflow. No user interaction is needed (UI:N) and no special non-default feature toggle is indicated - PowerShell is present by default on all affected editions. The primary limiting factor is the local-access and prior-authentication prerequisite: this cannot be exploited remotely or by an unauthenticated actor, which materially narrows the threat to post-foothold scenarios such as shared systems, lateral movement, or privilege escalation.

This is a credible but not emergency-tier priority. The provided CVSS 3.1 vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) describes a LOCAL (AV:L) attack requiring existing low-privilege authentication (PR:L) with low complexity and no user interaction, yielding total confidentiality/integrity/availability impact within an unchanged scope. The CISA SSVC framework corroborates this profile: Technical Impact is 'total' (consistent with C:H/I:H/A:H and arbitrary code execution), but Exploitation is 'none' and Automatable is 'no' - meaning no observed exploitation and the local, non-wormable nature limits mass automation. There is no CISA KEV listing and no EPSS score was provided, so no probabilistic exploitation signal is available; absence of EPSS is a data gap, not evidence of low risk. The signals are internally consistent rather than conflicting: a local, authenticated code-execution flaw with total impact that is not currently exploited. The practical consequence is privilege/integrity escalation on a host where the attacker already has a foothold, so this matters most for shared, multi-user, or hardened-workstation Windows environments and should be patched on normal-to-expedited cycles rather than treated as an active-exploitation fire drill.

An attacker who already holds a low-privileged authenticated session on a Windows host (AV:L/PR:L) supplies specially crafted input to a vulnerable PowerShell code path, triggering an integer overflow (CWE-122 heap-based buffer overflow) that corrupts heap memory. By controlling the overflow, the attacker executes arbitrary code in the context of the vulnerable process, escalating beyond their initial privileges. No public exploit identified at time of analysis, and no user interaction is required once local access is obtained.