Windows Search EUVD-2026-99914

Exploitation requires the attacker to already hold a low-privileged authenticated local account on the target host (PR:L, AV:L) and to interact with the Windows Search component in a way that triggers the use-after-free. The HIGH attack complexity (AC:H) is itself the key limiting factor: the flaw is a memory-corruption/race condition that the attacker must reliably win, so success is timing-dependent and not guaranteed on each attempt. No user interaction is needed (UI:N). There is no remote attack surface and no default-configuration remote exposure - the Windows Search service is present by default on supported Windows client and server editions, but reaching the flaw still requires prior local code execution or an interactive logon.

This is a CVSS 7.0 (High) local privilege-escalation flaw whose real-world risk signals are mostly moderate-to-low despite the serious technical impact. The CVSS vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N shows local-only attack vector, HIGH attack complexity, and LOW privileges required - meaning the attacker must already have an authenticated foothold on the host and must win a non-trivial condition (typical of use-after-free race conditions) to succeed. CISA's SSVC decision framework reinforces a non-urgent posture: Exploitation=none (no observed exploitation), Automatable=no (cannot be reliably weaponized at scale), though Technical Impact=total (full C:H/I:H/A:H on the local system). No EPSS score, KEV listing, or public POC is present in the provided data, so exploitation probability cannot be quantified and there is no evidence of active exploitation. The combination of AV:L + AC:H + SSVC Automatable=no makes this a credible but lower-priority item than its 7.0 score alone suggests - it is a privilege-escalation building block for an attacker who already has code execution, not an internet-facing mass-exploitation risk. No key signals conflict; the main gap is the absence of EPSS/KEV/POC data, which limits confidence on likelihood rather than impact.

An attacker who has already gained low-privileged, authenticated access to a Windows host (e.g., via phishing, a prior exploit, or a standard user account) triggers the use-after-free in the Windows Search component to corrupt memory and execute code in a higher-privileged context, achieving full local SYSTEM-level compromise. Because of the HIGH attack complexity (AV:L/AC:H), the attacker must reliably win a timing/race condition, so exploitation is not trivial. No public exploit code was identified at the time of analysis.