Windows Core Messaging EUVD-2026-99925

Requires the attacker to already have local, authenticated access with at least low-level privileges on the target (CVSS PR:L, AV:L) and the ability to execute a crafted program that reaches the Windows Core Messaging code path; no user interaction is needed (UI:N) and attack complexity is low (AC:L). Exploitation is LIMITED by the need for prior code-execution/logon on the host - it cannot be triggered remotely or by an unauthenticated attacker - making it a privilege-escalation primitive usable only after an initial foothold. Affected builds are those below the patched versions listed in the EUVD (e.g., Windows 11 24H2 below 10.0.26100.9711, Server 2025 below 10.0.26100.33650); fully patched systems are not exploitable.

This is a classic local elevation-of-privilege (EoP) issue in Windows Core Messaging, and the signals are internally consistent rather than conflicting. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N) confirms it requires local access and existing low-level authenticated privileges, with no user interaction and low attack complexity, yielding full C:H/I:H/A:H impact - matching the 7.8 (High) base score and CWE-822 (untrusted pointer dereference). The SSVC decision framework corroborates a measured priority: Exploitation 'none' (no observed or public exploitation), Automatable 'no' (consistent with a local vector that cannot be sprayed remotely), but Technical Impact 'total' (an attacker who succeeds gains full SYSTEM-level control). There is no EPSS score, no CISA KEV listing, and no POC indicated in the input, so exploitation probability signals are absent rather than low - this should be read as 'not yet observed,' not 'proven low risk.' The practical verdict: a genuine patch-worthy EoP that is valuable as a second-stage/post-compromise privilege escalation primitive, but not an initial-access or wormable threat. Prioritize it in normal Patch-Tuesday cadence for Windows fleets rather than as an emergency, unless it is later chained with a remote foothold or added to KEV.

An attacker who has already gained a foothold as a standard, low-privileged user on a Windows host (e.g., via phishing or a stolen credential) runs a crafted program that triggers the untrusted pointer dereference in Windows Core Messaging. By controlling the dereferenced pointer, they corrupt kernel/privileged memory and escalate to SYSTEM, taking full control of the machine. No public exploit code is identified at time of analysis, and the local-only, low-complexity vector means this is a realistic post-compromise escalation step rather than a remote entry point.