Windows ClipSVC CVE-2026-100201

Requires pre-existing local, authenticated access as a low-privileged user (AV:L, PR:L) who can reach and interact with the Windows Client License Service; no user interaction is needed (UI:N). Exploitation is limited by high attack complexity (AC:H), characteristic of a heap-overflow condition that likely depends on a race window or specific heap state, reducing reliability and often requiring repeated attempts. There is no remote or unauthenticated path, which meaningfully constrains real-world risk to scenarios where an attacker has already achieved initial foothold on the host (notably multi-user, terminal-server, or shared workstations).

This is a local privilege-escalation flaw (CVSS 3.1 base 7.0, AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) in the Windows Client License Service, with full confidentiality, integrity, and availability impact - consistent with attacker-controlled code execution at an elevated (likely SYSTEM) context. The real-world signals are moderate rather than urgent: the attack vector is local (AV:L), so an attacker must already have the ability to run code as a low-privileged user on the host (PR:L), and exploitation is rated high-complexity (AC:H), which for a heap overflow (CWE-122) typically implies a race condition or precise heap-grooming that reduces reliability. No EPSS score, no CISA KEV listing, and no public proof-of-concept were provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Net: this is a credible second-stage escalation primitive useful after initial access, not a mass-exploitable remote threat - a 'patch in normal cycle, prioritize on multi-user/shared hosts' issue rather than an emergency. Note the CVSS vector and the description agree (both indicate local, authorized access), so there is no signal conflict to flag, but the absence of any EPSS/KEV/POC data means exploitation likelihood is unquantified rather than confirmed-low.

An attacker who has already gained low-privileged code execution on a Windows host (e.g., via phishing or a compromised standard user account) interacts with the Client License Service to trigger a heap-based buffer overflow, corrupting heap memory to hijack execution and elevate to SYSTEM. Because the flaw is high-complexity (AC:H), the attacker likely needs to win a race or carefully groom the heap, so exploitation may require multiple attempts. No public exploit code is identified at time of analysis.