CVE-2026-83725

8.8High

Published 13 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash

8.8High

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required
Impact: Full C/I/A compromise
Weakness: CWE-122, CWE-190

Impact

Remote attackers can execute arbitrary code over the network, but it requires user interaction to trigger. Once triggered, the attacker gains the execution privileges of the Windows Search component.

Root cause

An integer overflow leads to a heap-based buffer overflow when parsing input in the Windows Search Component.

Affected systems

Versions not listed — check the vendor advisory.

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Fix & remediation

Install the official security update from Microsoft for Windows Search. As an interim mitigation, disable or stop the Windows Search service (WSearch) if patching must wait.

shell

$ Stop-Service -Name WSearch -Force; Set-Service -Name WSearch -StartupType Disabled

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Heap-based buffer overflow in Microsoft Windows Search Component allows an unauthorized attacker to execute code over a network.

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83725

Source: nvd.nist.gov/vuln/detail/CVE-2026-83725