Windows CSC Service CVE-2025-62466

Requires the attacker to already possess a local, authenticated foothold (PR:L) with the ability to execute code that interacts with the Windows Client-Side Caching (CSC / Offline Files) Service on the target host. No user interaction is needed (UI:N) and no network reachability is involved (AV:L). The primary limiting factor is the prerequisite local low-privilege access - this cannot be reached remotely or by an unauthenticated actor - making it a post-compromise escalation step. The CSC service is a standard OS component, so no special non-default configuration is required across the affected Windows 10, Windows 11, and Windows Server builds listed in the CPE data.

All CVSS signals point to a classic local privilege-escalation issue, not a remotely weaponizable one: the vendor CVSS:3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8 HIGH) requires the attacker to already have local, authenticated (PR:L) code-execution on the host before the CSC Service flaw can be triggered. EPSS is low at 0.40% (32nd percentile), consistent with a local-only EOP that is not mass-scanned or opportunistically exploited. There is no CISA KEV listing and no public exploit code identified, so exploitation status is 'no public exploit identified at time of analysis.' The signals are internally consistent - low EPSS, no KEV, no POC, and AV:L all agree this is a patch-on-cycle EOP rather than an emergency. One tension worth noting: the CWE (476, null pointer dereference) and the 'Denial Of Service' tag suggest a crash primitive, yet the vendor rates full C:H/I:H/A:H and titles it privilege elevation, implying the null deref is being leveraged for kernel-level control rather than a simple bugcheck; the EOP framing from MSRC takes precedence over the DoS tag. Real priority is MODERATE and driven almost entirely by the ubiquity of the affected Windows base, not by exploitation likelihood - it is a useful post-compromise link in a chain (e.g., paired with an initial RCE), not a standalone high-urgency threat.

An attacker who has already gained a low-privileged foothold on a Windows host - via phishing payload, a compromised service account, or a prior RCE - invokes the Client-Side Caching (offline files) Service with crafted input that triggers a null pointer dereference, manipulating the resulting kernel condition to execute code at SYSTEM. No user interaction or network access is required beyond the initial local session. No public proof-of-concept exploit has been identified at the time of analysis.