Windows Input System EUVD-2026-99986

Exploitation requires the attacker to already possess local, authenticated low-privileged access (PR:L) to a vulnerable Windows system - this is a privilege-escalation flaw, not a remote entry point, so it cannot be triggered over the network (AV:L). The specific trigger is interaction with the Windows Input System that induces a type-confusion (incompatible-type resource access) condition; no special non-default configuration is described by the vendor and no user interaction is needed (UI:N), and attack complexity is low (AC:L). The primary limiting factor is the local-access prerequisite: environments where untrusted users have interactive or shell access (shared/multi-user workstations, RDP/terminal servers, VDI) are most exposed, while single-user endpoints face materially lower realistic risk. Affected builds include Windows 10 (1809/21H2/22H2), Windows 11 (23H2/24H2/25H2/26H1/26H2), and Windows Server 2019/2022/2025; patched builds are available from Microsoft.

This is a locally-exploitable elevation-of-privilege flaw with a solid-but-not-emergency risk profile. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8 HIGH) indicates an attacker who already has low-privileged authenticated access to the machine can, with low complexity and no user interaction, achieve full confidentiality/integrity/availability impact on the local system - consistent with a type-confusion (CWE-843) memory-corruption primitive in the Windows Input System being leveraged for privilege escalation. Multiple signals argue against treating this as a top-of-queue emergency: CISA SSVC lists Exploitation as 'none' and Automatable as 'no' (though Technical Impact is 'total'), there is no CISA KEV listing, and no public exploit was identified in the provided data. The local-only attack vector means it is not usable for initial remote access and functions as a second-stage escalation after a foothold is obtained. The one notable tension is that SSVC Technical Impact 'total' and the all-High CVSS impacts correctly flag severe consequences if exploited, yet Automatable 'no' plus the local vector limit mass-exploitation potential - so this is a real priority for systems where untrusted users have local access (shared workstations, terminal servers, multi-tenant hosts), but lower urgency for single-user endpoints. EPSS score was not provided in the input and cannot be assessed.

An attacker who has already gained low-privileged code execution on a Windows host (e.g., via phishing, a compromised standard user account, or a separate RCE) invokes a crafted interaction against the Windows Input System that triggers the type-confusion condition, corrupting memory to run code in a higher-privileged context such as SYSTEM. No public proof-of-concept was identified at the time of analysis, and no user interaction is required (UI:N), making it a reliable local-escalation step once a foothold exists.