System Information Console EUVD-2026-99870

Exploitation targets the Windows System Information Console component and, per CVSS AV:N/AC:L/PR:N/UI:N, requires no authentication, no user interaction, and only network reachability to the vulnerable component. The practical limiting factor is network exposure of that console/service: hosts where the affected component is not network-accessible (e.g. blocked by host or perimeter firewall) are not reachable by a remote attacker. All supported Windows client and server builds below the patched versions listed in EUVD (e.g. Windows 11 24H2 <10.0.26100.9711, Server 2025 <10.0.26100.33650, Server 2016 <10.0.14393.9612) are affected until the vendor update is applied.

Signals diverge in an informative way. The CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N) describes a maximally dangerous flaw: remote, network-reachable, no authentication, no user interaction, with total confidentiality/integrity/availability impact (C:H/I:H/A:H) - consistent with a heap-based buffer overflow (CWE-122) yielding remote code execution. CISA SSVC reinforces the ceiling with Automatable:yes and Technical Impact:total, meaning that once an exploit exists it could be reliably scaled. However, SSVC Exploitation is explicitly 'none', there is NO CISA KEV listing, NO public POC reported in the provided data, and NO EPSS probability was supplied, so near-term real-world exploitation is currently UNPROVEN despite the perfect-storm CVSS vector. The practical takeaway: this is a genuine high-priority patch-now item because the product (Windows) is ubiquitous, a vendor patch already exists, and the flaw is automatable with total impact - but it is NOT yet an emergency driven by observed in-the-wild activity. Treat it as a high-value target that will likely attract exploit development rather than something confirmed to be under attack today. Missing EPSS and the absence of any technical exploitation detail in the single MSRC reference are the main gaps; weaponization difficulty of the heap overflow cannot be judged from the data provided.

A remote, unauthenticated attacker sends specially crafted data to a vulnerable Windows System Information Console component reachable over the network, triggering a heap-based buffer overflow that corrupts memory and allows arbitrary code execution in the context of the affected process. No user interaction or credentials are required per the CVSS vector. No public exploit identified at time of analysis, so this reflects the theoretical attack path rather than an observed campaign.