Windows Management Services EUVD-2026-99637

Exploitation requires the attacker to already hold a low-privileged authenticated local session on the affected host (AV:L/PR:L) - this is a post-compromise local privilege-escalation primitive, not remotely reachable. The specific trigger is interaction with the Windows Management Services component to drive the use-after-free; no victim user interaction is needed (UI:N) and it works against default configurations of the listed Windows 11 (23H2 through 26H2) and Windows Server 2025 builds below their patched revisions. Limiting factors: the attacker must first achieve local code execution as a standard user, and successful UAF-to-EoP exploitation typically requires reliable heap/object grooming, which raises practical (though not CVSS-scored) difficulty.

This is a moderately-high but not emergency-priority vulnerability. The CVSS 3.1 base score of 7.8 is driven entirely by local impact: AV:L requires the attacker to already have local code-execution, AC:L and PR:L mean a low-privileged authenticated user can trigger it reliably with no user interaction, and the C:H/I:H/A:H/S:U combination reflects total compromise of the single affected system (full SYSTEM-level control). The signals are internally consistent and point to a genuine but second-stage risk rather than a perimeter-breaking flaw. Critically, the exploitation-pressure signals are all LOW: CISA SSVC reports Exploitation: none and Automatable: no, there is no CISA KEV listing, and no public POC is referenced - so no public exploit identified at time of analysis. EPSS is not provided in the input, so near-term exploitation probability cannot be quantified. SSVC Technical Impact: total agrees with the CVSS total-impact metrics. Net: a real privilege-escalation issue worth patching on a normal Patch-Tuesday cadence as part of a defense-in-depth posture (it is a powerful post-compromise primitive), but current evidence does NOT indicate active or imminent widespread exploitation. The 'Denial Of Service' tag is somewhat at odds with the privilege-elevation framing, though a use-after-free plausibly yields both memory-corruption crash (DoS) and EoP outcomes.

A low-privileged authenticated user (or malware already running in a standard user context after a phishing or drive-by foothold) invokes the vulnerable Windows Management Services code path to trigger the use-after-free, grooming the freed object to gain control of execution and elevate to SYSTEM. Because AV:L/PR:L/UI:N, exploitation is local, needs only low privileges, and requires no victim interaction. No public exploit code is identified at time of analysis, so weaponization would require original exploit development against a UAF primitive.