User Profile Service EUVD-2026-99938

Requires the attacker to already hold valid low-privileged, authenticated local access to the target Windows system (CVSS PR:L, AV:L) - there is no remote or network vector. Exploitation abuses improper link resolution (CWE-59): the attacker must be able to create a symbolic link, junction, or hardlink in a location the Windows User Profile Service processes, so that a privileged file operation is redirected to an attacker-chosen path. Attack complexity is low (AC:L) and no user interaction is needed (UI:N), meaning no victim action or timing/race prerequisite is called out. Limiting factors: the need for an existing authenticated local foothold, the ability to write links in a service-accessed directory, and the absence of any remote trigger; this is a post-exploitation escalation, not an entry point. Default Windows configurations are affected (no special feature must be enabled per the description).

This is a locally-exploitable elevation-of-privilege flaw (CVSS 3.1 7.8, AV:L/AC:L/PR:L/UI:N) in the Windows User Profile Service, a core OS component. The signals are internally consistent and point to a genuine but not emergency priority. CVSS confirms low attack complexity and only low privileges required (any authenticated local user), with high confidentiality, integrity and availability impact - classic SYSTEM-level EoP. CISA's SSVC framing agrees it is serious-but-not-urgent: Exploitation='none' (no observed exploitation), Automatable='no' (local, requires an existing foothold), Technical Impact='total'. No EPSS score was provided, there is no CISA KEV listing, and no public exploit was supplied in the input, so this is not a drive-by or wormable threat. The realistic use case is a second-stage privilege escalation after an attacker already has code execution as a standard user. Note one data inconsistency to verify: the CVE is tagged 'Information Disclosure', but the description and the C:H/I:H/A:H vector describe privilege elevation, not disclosure - treat the tag as mislabeled. Priority: high for patch management on endpoints and multi-user/terminal-server hosts, but it is not a remote-exploitation emergency.

An attacker who already has low-privileged, authenticated local access to a Windows host (e.g., via phishing, a standard user account, or a prior foothold) plants a crafted symbolic link or junction that the User Profile Service resolves during a privileged file operation. Because the service follows the link without proper validation (CWE-59), the operation is redirected to a protected location, letting the attacker gain SYSTEM privileges. No public exploit was identified at time of analysis, and exploitation requires local access, so this is a post-compromise escalation rather than an initial-access vector.