Windows StateRepository API CVE-2026-102216

Exploitation requires local code execution as an already-authenticated low-privileged user on the target Windows system (AV:L, PR:L); the attacker must be able to call the Windows StateRepository API locally to trigger the type-confusion condition. There is no network vector and no user interaction is required (UI:N), but the mandatory local foothold and valid low-level credentials are the primary limiting factors - the flaw cannot be reached remotely or by an unauthenticated actor, making it a post-compromise privilege-escalation primitive rather than an initial-access vulnerability.

This is a credible local privilege-escalation vulnerability but not an emergency-tier internet-facing threat. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) describes a type-confusion flaw (CWE-843) in the Windows StateRepository API that a locally present, already-authenticated attacker (PR:L) can exploit with low complexity and no user interaction to gain full confidentiality, integrity, and availability impact - i.e., elevation to a higher privilege context. The requirement for local access and existing low-level credentials (AV:L, PR:L) means this is a second-stage vulnerability: an attacker needs an initial foothold (malware execution, compromised standard user, or a chained remote bug) before it is useful. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no signal of active exploitation or widespread exploit availability at this time; treat it as a patch-on-normal-cadence EoP rather than a drop-everything issue, while noting that Microsoft StateRepository EoP bugs are historically attractive for post-exploitation chains. Key limitation of this assessment: no EPSS, SSVC, KEV, or POC data was supplied, so the real-world exploitation-probability dimension is simply unknown rather than confirmed low.

An attacker who already has a low-privileged foothold on a Windows host (e.g., via phishing-delivered malware or a compromised standard user account) invokes the StateRepository API with crafted input that triggers the type-confusion condition, corrupting memory to execute code in a higher-privileged context. This yields SYSTEM-level control, enabling credential theft, tampering, or persistence. No public exploit code was identified in the provided data, so exploitation currently requires original development.