Windows NTLM EUVD-2026-99960

Exploitation requires the attacker to already have local, authenticated low-privileged code execution on the target Windows system (CVSS PR:L, AV:L) - this is a post-compromise privilege-escalation primitive, not a remote entry point. Once that foothold exists, no user interaction and no special configuration are needed (UI:N, AC:L): the NTLM component is a default, always-present part of Windows, so default installations of the listed client and server builds are affected. The key limiting factors are the need for prior local access and an existing (even if minimal) privilege level; there is no network-facing exposure, which substantially narrows realistic risk versus a remote flaw.

This is a credible but second-tier priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) describes a local elevation-of-privilege flaw: the attacker must already have local, low-privileged code execution on the host before triggering the heap overflow, which bounds blast radius to post-compromise escalation rather than initial remote entry. CISA's SSVC framework aligns and tempers the picture - Exploitation: none (no observed or public exploitation), Automatable: no (consistent with a local EoP that cannot be mass-scanned/wormed), but Technical Impact: total (full C/I/A compromise of the host once exploited). No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of in-the-wild use; this is NOT a confirmed actively-exploited bug. The signals are internally consistent (local vector + not-automatable + no exploitation + a flaw class, NTLM/heap overflow, that is hard to weaponize reliably), so there is no major contradiction to flag - the main caveat is simply that absence of EPSS/KEV/POC data means exploitation likelihood is inferred, not measured. Net: patch it on a normal-to-prompt cycle (classic Patch-Tuesday EoP used as a chaining primitive after initial access), but it is not a drop-everything network-exploitable emergency.

An attacker who has already gained an initial low-privileged foothold on a Windows host (e.g. via phishing, a malicious document, or a compromised service account) runs a crafted local process that interacts with the NTLM component to trigger a heap-based buffer overflow, corrupting heap memory to hijack execution and escalate to SYSTEM. No user interaction is required and attack complexity is low, but local access and some existing privilege are prerequisites. No public exploit code was identified at the time of analysis.