Windows SmartScreen EUVD-2026-99859

Requires an attacker to already have interactive, low-privileged local access and the ability to run code on the target Windows host - there is no remote or network vector (AV:L) and no path for an unauthenticated user (PR:L). Exploitation targets the Windows SmartScreen component, which is present by default, so no non-default feature toggle is implied by the description; however, the attacker must first establish a foothold and then successfully trigger and groom the type-confusion condition. Limiting factors per CISA SSVC: exploitation is not automatable and none has been observed, meaning realistic abuse is as a manual post-compromise escalation step rather than mass exploitation. The host must be running an affected build below the patched versions listed for each Windows release (e.g., Windows 11 24H2 below 10.0.26100.9711).

This is a moderate-priority, not top-tier, issue. The CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects high technical impact but a constrained reach: exploitation is local (AV:L) and requires an attacker who is already authenticated with at least low privileges on the host (PR:L). It is an elevation-of-privilege flaw, so the value to an attacker is as a post-compromise escalation step, not an initial entry vector. The supporting signals downgrade urgency relative to the raw score: CISA SSVC lists Exploitation as 'none' and Automatable as 'no' (consistent with a local EoP that cannot be sprayed at scale), though Technical Impact is 'total'. There is no CISA KEV listing and no public proof-of-concept in the provided data, so exploitation status is 'no public exploit identified at time of analysis'. No EPSS score was provided, which is a gap - it would normally help rank this among the Patch Tuesday volume. Net: a genuine but non-emergency patch item best prioritized behind any remotely exploitable or actively-exploited bugs, while still deserving prompt remediation on multi-user or workstation hosts because the impact ceiling is full compromise of confidentiality, integrity, and availability.

An attacker who has already gained low-privileged code execution on a Windows host (e.g., via phishing, a standard user account, or a prior foothold) invokes a crafted operation that triggers the type-confusion flaw in Windows SmartScreen, causing it to misinterpret a resource's type. By grooming the mismatched object, the attacker corrupts memory in a higher-privileged context and escalates to SYSTEM-level privileges. No public exploit code is identified at time of analysis, and the attack cannot be performed remotely or without an existing local session.