Windows AI EUVD-2026-99662

Exploitation requires the attacker to already hold a local, authenticated foothold on the target (PR:L, AV:L) - e.g. a standard interactive or service account on an affected Windows 11 24H2/25H2/26H1/26H2 or Windows Server 2025 host - and the ability to write a malicious DLL into a directory that the Windows AI component searches ahead of the trusted location (CWE-427 uncontrolled search path). No user interaction is needed (UI:N) and attack complexity is low (AC:L), but the dependence on pre-existing local access and on the presence/use of the Windows AI component is the primary limiting factor; purely remote or unauthenticated attackers cannot trigger this directly. Hosts where untrusted users cannot obtain local accounts, or where the Windows AI feature is not present/enabled, face materially lower real-world exposure.

This is a credible but not emergency-level priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) describes a local privilege-escalation flaw: the attacker must already have local, authenticated access (PR:L) to a Windows host before exploitation, which bounds the blast radius to post-compromise escalation rather than initial remote access. Multiple signals agree that this is NOT widespread active exploitation: CISA's SSVC decision framework reports Exploitation=none and Automatable=no, there is no CISA KEV listing, and no public POC is referenced - so exploitation status is 'no public exploit identified at time of analysis.' Counterbalancing this, SSVC rates Technical Impact as 'total' (consistent with the C:H/I:H/A:H impact - full SYSTEM-level compromise once exploited), and a vendor patch is already available, which is typical of a real, vendor-confirmed defect rather than a theoretical one. The CWE-427 (uncontrolled search path / DLL-hijack) pattern is a well-understood and reliable escalation technique, so once a local foothold exists the barrier to weaponization is low even though no exploit is public today. Net: treat as a standard-to-elevated patch priority (especially on multi-user hosts and servers where untrusted local principals exist), not a drop-everything issue.

An attacker who already has a low-privileged local account on an affected Windows 11 (24H2/25H2/26H1/26H2) or Windows Server 2025 host places a malicious DLL in a directory that the Windows AI component searches before the legitimate path. When the component loads the planted library, the attacker's code runs with the elevated privileges of that process, yielding full (C:H/I:H/A:H) compromise. No public exploit code is identified at time of analysis, and the attack requires prior local authenticated access (PR:L) with no user interaction (UI:N).