Windows Server 2012 CVE-2026-26176

Authenticated local user account required. Windows Client Side Caching (csc.sys) driver must be present and accessible. Vulnerability requires direct interaction with csc.sys IOCTLs through legitimate local access.

Despite the high CVSS base score of 7.8, real-world risk is moderate and highly context-dependent. The attack vector requires local authenticated access (AV:L, PR:L), meaning an attacker must already have compromised a valid user account or have physical/RDP access to the target system. This significantly reduces the attack surface compared to remotely exploitable vulnerabilities. The low attack complexity (AC:L) and no user interaction requirement (UI:N) indicate that exploitation is straightforward once local access is achieved, making this a reliable privilege escalation primitive in multi-stage attacks. No confirmed active exploitation exists (not present in CISA KEV), and no public exploit code has been identified at time of analysis, reducing immediate urgency. However, the complete impact to confidentiality, integrity, and availability (C:H/I:H/A:H) means successful exploitation grants full SYSTEM control. From an SSVC perspective: exploitation status is none-detected, technical impact is total (full kernel compromise), and automatable is no (requires prior authentication). The broad affected product range-spanning all current Windows client and server versions-creates a wide exposure window in enterprise environments where patching cycles may lag. Organizations should prioritize this for systems with multiple users or those accessible to lower-privileged accounts, especially in environments where initial access vectors (phishing, exposed RDP) are prevalent. The availability of vendor patches mitigates risk substantially for organizations with mature patch management processes.

An authenticated local user crafts a malicious request to the Windows csc.sys driver with oversized cache metadata. The heap overflow overwrites adjacent memory structures, allowing code execution with SYSTEM privileges for privilege escalation.