Windows User Profile EUVD-2026-99754

Exploitation requires the attacker to already hold valid low-privileged authenticated access to the target host and the ability to execute a crafted local program - there is no remote or network path (AV:L) and no user interaction is needed. The flaw lies in the Windows Internal System User Profile component, so exploitation exercises that subsystem's object handling rather than any optional or non-default feature; no special configuration toggle is indicated by the advisory. Limiting factors: the attacker must first gain a foothold on the machine, and reliable UAF exploitation typically requires precise control of memory allocation timing, which the SSVC Automatable=no rating reflects. Affected builds span Windows 10 (1607/1809/21H2/22H2), Windows 11 (23H2/24H2/25H2/26H1/26H2), and Windows Server 2016/2019/2022/2025 below the patched build numbers listed in EUVD.

This is a locally-exploitable use-after-free (CWE-416) elevation-of-privilege flaw in the Windows Internal System User Profile component. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) indicates an authenticated local attacker with low privileges can achieve full confidentiality, integrity, and availability impact with low attack complexity and no user interaction. Signals are consistent but point to a moderate rather than emergency priority: CISA's SSVC decision framework reports Exploitation=none (no observed or public exploitation) and Automatable=no, while Technical Impact=total aligns with the C:H/I:H/A:H rating. No EPSS score was provided, there is no CISA KEV listing, and no public proof-of-concept was referenced, so there is no evidence of active exploitation at this time. The practical risk is that of a classic local privilege-escalation primitive: not remotely reachable and requiring a pre-existing foothold, but valuable to an attacker who already has code execution on a host as part of a post-compromise chain. Given the ubiquity of Windows, patch prioritization is warranted on standard patch-cycle timelines rather than as an out-of-band emergency.

An attacker who already has low-privileged authenticated access to a Windows host (for example, via phishing, a compromised standard user account, or a prior low-level foothold) runs a crafted local program that triggers the use-after-free in the Internal System User Profile component. By manipulating the freed object's memory, they corrupt kernel/system state to execute code at SYSTEM-level privileges. No public exploit code was identified at time of analysis, so exploitation would currently require independent development.