Windows Update Service CVE-2026-100200

Exploitation requires an authenticated low-privilege local account on the target Windows host (PR:L, AV:L) and the ability to run code that interacts with the Windows Update Service to trigger the use-after-free; no user interaction is needed (UI:N). The key limiting factor is high attack complexity (AC:H): the attacker must reliably win a race to reuse the freed object, so exploitation is not deterministic and favors an attacker who already has a foothold. There is no remote or network vector and no default-configuration exposure to unauthenticated attackers.

CVSS 3.1 base score is 7.0 (HIGH) with vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning local access, high attack complexity, and low-privilege authentication are required, but full confidentiality, integrity, and availability impact follow once exploited. The high attack complexity (AC:H) is consistent with CWE-416 use-after-free bugs, which typically require winning a timing/race window to control freed memory - a meaningful barrier to reliable exploitation. No EPSS probability was provided in the input, the CVE is NOT on the CISA KEV list, and no public proof-of-concept is referenced, so there is no public exploit identified at time of analysis. The combination of local-only vector plus high complexity plus required authentication places this below internet-facing critical bugs in priority; it is a credible local privilege-escalation chain component (e.g., post-compromise escalation to SYSTEM) rather than an urgent remote threat. The only reference is a Microsoft MSRC advisory stub, so EPSS and exploitation telemetry are simply absent rather than conflicting - treat the lack of exploitation signal as missing data, not as confirmation of low interest.

A low-privileged authenticated user already present on a Windows host runs a crafted local program that repeatedly triggers and races the use-after-free condition in the Windows Update Service, eventually reclaiming the freed object to hijack execution and elevate to SYSTEM. No public proof-of-concept is referenced, and the high attack complexity means the exploit must reliably win a memory-reuse race, limiting it to a skilled local attacker or malware with an existing foothold.