Internet Messaging API EUVD-2026-99993

Exploitation requires an attacker to deliver specially crafted content that is parsed by the Microsoft Internet Messaging API, and requires the victim to interact with it - opening or previewing the malicious message (UI:R) - so it cannot be triggered against an unattended service. No authentication or prior privileges are needed (PR:N), and no special non-default configuration is indicated by the description; the primary limiting factor is the mandatory user interaction and the need for the vulnerable, unpatched component (versions below the fixed builds listed in EUVD, e.g. Windows 11 24H2 <10.0.26100.9711, Server 2025 <10.0.26100.33650). Systems patched to the vendor-fixed build are not exploitable.

This is a credible, high-priority patching target but not an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity, unauthenticated code-execution flaw with total impact on confidentiality, integrity, and availability - but it is gated by user interaction (UI:R), making it a client-side rather than a wormable server-side bug. This aligns with the SSVC assessment: Exploitation=none (no observed or public exploitation), Automatable=no (the required user interaction prevents reliable mass automation), and Technical Impact=total (consistent with the C:H/I:H/A:H and heap-based RCE nature). There is NO CISA KEV listing and NO evidence of a public proof-of-concept, so exploitation status is 'no public exploit identified at time of analysis.' No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified. Signals are internally consistent - there is no conflict between CVSS, SSVC, and the description - so the practical read is: a serious memory-corruption RCE in a ubiquitous Windows component, worth prioritizing because of the huge install base and total impact, but currently lacking any active-exploitation or public-exploit pressure that would escalate it to drop-everything status.

An attacker crafts a malicious message or content that is processed by the Microsoft Internet Messaging API and lures a user into opening or previewing it (UI:R), triggering a heap-based buffer overflow (CWE-122). Successful corruption of heap memory lets the attacker execute arbitrary code in the context of the targeted user over the network, with no authentication required. No public exploit code has been identified at the time of analysis.