Windows Image Acquisition EUVD-2026-99628

Exploitation requires the attacker to already possess low-privileged authenticated local access (PR:L) to the target Windows system - this is not remotely exploitable (AV:L). The attacker must interact with the Windows Image Acquisition (WIA) service/component and successfully win a use-after-free timing window (AC:H), which materially limits reliability and rules out trivial automation (SSVC Automatable=no). No user interaction from a victim is needed (UI:N). The primary limiting factors are the need for an existing foothold, the high complexity of exploiting the memory-corruption race, and the requirement that the vulnerable WIA code path be reachable - applicable to default Windows installations across the listed client and server builds prior to the patched versions.

This is a credible but not top-tier priority. The CVSS 3.1 base score of 7.0 (High) reflects a local, authenticated use-after-free in Windows Image Acquisition with full confidentiality, integrity, and availability impact (C:H/I:H/A:H) but notably high attack complexity (AC:L is NOT set - AC:H), which is typical for UAF/race conditions that require winning a timing window. The CISA SSVC framework corroborates a moderate posture: Exploitation=none (no observed exploitation), Automatable=no (consistent with AC:H - not a point-and-click mass-exploit candidate), yet Technical Impact=total (consistent with the CWE-416 memory-corruption primitive enabling SYSTEM-level privilege escalation). No EPSS score was supplied, and the vulnerability is NOT in CISA KEV, so there is no evidence of active exploitation. No public exploit code was indicated. The signals are internally consistent rather than conflicting: a high-impact-but-hard-to-exploit local EoP, requiring an attacker to already have a foothold with low privileges. This is a patch-in-normal-cycle item for most organizations rather than an emergency, though the ubiquity of Windows raises aggregate exposure. One data caveat: the input Tags include 'Denial Of Service,' which conflicts with the description (privilege elevation) and the C:H/I:H/A:H vector - treat the EoP characterization from Microsoft/NVD as authoritative.

An attacker who already has low-privileged, authenticated access to a Windows host (e.g., via a standard user account or a compromised low-integrity process) triggers a use-after-free in the Windows Image Acquisition service by manipulating object lifetime during a crafted imaging/scanner operation. By winning the race condition and controlling the freed memory, they corrupt kernel or service state to execute code at higher privilege (SYSTEM). No public exploit was identified at time of analysis, and the high attack complexity means reliable exploitation requires precise timing.