EUVD-2026-99968
GHSA-qmqj-27r2-pp5h
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted file to victim
-
DeliveryVictim opens/previews triggering Search indexing
-
ExploitHeap buffer overflow in Windows Search parser
-
ExecutionExecute arbitrary code as user
-
ImpactCompromise host
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the Windows Search Component to process attacker-controlled input and requires victim user interaction (UI:R) - e.g., a user opening, previewing, or indexing a maliciously crafted file or resource. No authentication or privileges are needed (PR:N), and default configurations are affected since Windows Search is enabled by default across supported Windows client and server editions. The primary limiting factor is the mandatory user interaction, which blocks fully automatic/wormable exploitation (consistent with SSVC Automatable: no); server-core installations are also listed as affected. Patched fixed builds are enumerated per edition (e.g., Windows 11 24H2 >=10.0.26100.9711, Server 2025 >=10.0.26100.33650). |
| Impact | This is a genuine high-priority vulnerability, though not the top tier of urgency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) indicates remote, low-complexity, unauthenticated code execution with total CIA impact, tempered by a required user interaction (UI:R). The SSVC decision framework partially corroborates severity - Technical Impact is rated 'total' - but Exploitation is 'none' and Automatable is 'no', signaling no observed exploitation and that the UI requirement prevents worm-like mass automation. This CVE is NOT in CISA KEV, and no public exploit code is indicated in the provided data; EPSS is not provided. The signals are therefore consistent rather than conflicting: high theoretical impact on a ubiquitous platform, but no evidence of real-world exploitation yet and a human-interaction barrier. Treat it as a priority patch for Windows fleets (vendor patch is available), but it is not an emergency drop-everything issue absent exploitation evidence. Note the UI:R vs AC:L combination means exploitation is easy once a user is tricked, so social-engineering-driven attacks are the realistic threat model. |
| Exploit ScenarioDerived | An attacker crafts a malicious file or network resource that, when accessed or previewed by a victim, is processed by the Windows Search indexing/query component and triggers a heap-based buffer overflow. Because exploitation requires user interaction (UI:R) but no privileges or authentication, a phishing or malicious-document delivery leads to arbitrary code execution in the user's context. No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Heap-based buffer overflow in the Microsoft Windows Search Component enables unauthenticated remote attackers to achieve arbitrary code execution, though exploitation requires victim user interaction (UI:R) to open, preview, or index attacker-controlled content. This affects default configurations across supported Windows client and server editions, including Server Core installations, and vendor patched builds are available. No public exploit code has been identified at time of analysis, and the SSVC assessment lists exploitation as none and automatable as no.
RemediationAI
Vendor-released patches are available via the Microsoft Security Response Center; apply the latest cumulative update to reach the fixed builds enumerated for each edition (for example, Windows 11 24H2 >=10.0.26100.9711, Windows 11 23H2 >=10.0.22631.7652, Windows 10 22H2 >=10.0.19044.7807, Windows Server 2025 >=10.0.26100.33650, Windows Server 2022 >=10.0.20348.5761, Windows Server 2019 >=10.0.17763.9376, Windows Server 2016 >=10.0.14393.9612, Windows Server 2012 R2 >=6.3.9600.23470, and Windows Server 2012 >=6.2.9200.26434). Refer to the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83725 for edition-specific downloads. If patching cannot be performed immediately, consider disabling the Windows Search service (WSearch) as a temporary compensating control - this removes the attack surface but disables desktop search, indexing, and preview functionality for users; alternatively, restrict indexing of untrusted network locations and disable preview handlers for risky file types, though these reduce rather than eliminate exposure. Because exploitation requires user interaction, user awareness measures to avoid opening or previewing untrusted files can help limit risk but should not replace patching.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 20 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-122 (heap-based buffer overflow) in the Microsoft Windows Search Component, which handles indexing, querying, and content preview of files and resources. The component parses attacker-controlled input and, due to insufficient bounds validation, can write beyond an allocated heap buffer, corrupting adjacent memory and potentially leading to code execution in the context of the search service. The network attack vector (AV:N) reflects delivery of malicious content over a network - for example, a crafted file or resource that is indexed, previewed, or opened - while the required user interaction (UI:R) aligns with SSVC's Automatable: no and Exploitation: none ratings. Affected systems include Windows 10, Windows 11, and Windows Server editions, with Server Core installations also vulnerable.
Know when Windows gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-reachable Search component parses attacker input with no auth (AV:N/PR:N) but needs a user to open the content (UI:R); memory-corruption RCE yields full CIA impact.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Heap-based buffer overflow in Microsoft Windows Search Component allows an unauthorized attacker to execute code over a network.
Executive ViewAI
A high-severity heap-based buffer overflow in the Microsoft Windows Search Component creates a remote code execution risk for supported Windows client and server editions, including Server Core installations, when users open, preview, or index attacker-controlled content. Because the component is present in default configurations, a successful exploit could allow code execution in the user’s context, potentially leading to data exposure, endpoint compromise, or follow-on lateral movement. Although no public exploit has been identified and exploitation requires user interaction, the broad Windows footprint and high CVSS score warrant management attention and prompt patching.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Twonky Server 8.5.2 uses hard-coded cryptographic keys for encrypting the administrator password. Combined with the cred
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Exploit-DB