Windows Shell EUVD-2026-99634

Exploitation requires the attacker to be unauthenticated (PR:N) and reach the victim over a network (AV:N), but is gated by mandatory user interaction (UI:R): a user must open or interact with attacker-supplied Shell content (a crafted file, link, or shell item) for the double-free to trigger. There is no scope change (S:U), so impact is confined to the context of the interacting user rather than the system. The limiting factors are the required user action and the fact that CISA assesses the attack as not automatable, meaning it suits targeted social-engineering delivery rather than unattended mass exploitation; no special non-default configuration is indicated by the available data.

This is a genuine priority despite no confirmed exploitation. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R) describes a network-reachable, low-complexity, unauthenticated flaw whose only barrier is user interaction, and the CVSS 8.8 is driven by total compromise (C:H/I:H/A:H). The CWE-122 heap double-free yielding remote code execution is a classic memory-corruption primitive. The signals are largely consistent but weighted toward latent rather than active risk: CISA SSVC reports Exploitation 'none' and Automatable 'no', which aligns with the UI:R requirement (a victim must open or interact with crafted content, so mass-automated exploitation is unlikely). No EPSS score was supplied, and the CVE is NOT in CISA KEV and has no POC indicator, so this is 'no public exploit identified at time of analysis'. The one point to verify: SSVC 'Technical Impact: total' corroborates the C:H/I:H/A:H rating, so there is no conflict there. Net: a high-value target for exploit development (Windows Shell is ubiquitous) that is currently unexploited - patch promptly, but the UI:R requirement and lack of automatability place it below truly wormable network RCEs.

An attacker crafts a malicious file, link, or shell item and lures a user into opening or interacting with it (e.g., via phishing or a malicious share), triggering a double-free in Windows Shell that corrupts the heap and leads to arbitrary code execution in the victim's context. No authentication is required of the attacker (PR:N), but successful exploitation depends on user interaction (UI:R). No public exploit code is identified at time of analysis.