Microsoft Windows Search EUVD-2026-99921

Exploitation requires the attacker to already have authenticated, low-privileged local code-execution on the host (CVSS PR:L, AV:L) - there is no remote or network path and no user interaction is needed (UI:N). The flaw lives in the Windows Search component, so the attacker must be able to invoke or influence Search operations to trigger the use-after-free. The key limiting factor is AC:H: the use-after-free depends on winning a timing race or reaching a precise freed-memory state, so exploitation is not guaranteed on a single attempt and is not automatable (SSVC Automatable=no). Scope is unchanged (S:U), meaning impact is confined to the local Windows system. This primarily raises risk on shared/multi-user systems (e.g., RDS/terminal servers) where untrusted low-privilege accounts exist.

Signals are consistent and point to a genuine but non-urgent local privilege-escalation issue rather than a mass-exploitation threat. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0) requires local access and already-held low privileges, and crucially sets AC:H - characteristic of a use-after-free (CWE-416) that depends on winning a race or achieving a specific heap state, which reduces reliability. The CISA SSVC framework corroborates low urgency: Exploitation=none (no observed or public exploitation), Automatable=no (matching AV:L/AC:H), though Technical Impact=total aligns with the C:H/I:H/A:H full-compromise outcome once exploited. There is no CISA KEV listing and no POC indicator, so this is not a confirmed in-the-wild threat. EPSS is not provided in the input, so probabilistic exploitation likelihood cannot be quoted. Net: a real priority for comprehensive patch cycles on Windows endpoints (especially multi-user/terminal servers where untrusted low-priv users exist), but it is not a drop-everything issue - the local-only vector, high attack complexity, and absence of active exploitation place it below internet-facing or wormable flaws.

A low-privileged but authenticated local user (or malware already running in a standard user context) triggers a use-after-free in the Windows Search component by manipulating its operations to reuse freed memory, then grooms the heap to gain code execution in a higher-privileged context. Because the CVSS vector sets AC:H, the attacker must reliably win a race or reach a specific memory state, so exploitation may require multiple attempts. No public exploit code is identified at time of analysis.