Windows Server 2012 CVE-2026-32150

Local attacker with low-privilege user account on Windows system running vulnerable Function Discovery Service (fdwsd.dll). No user interaction required. Successful exploitation requires precise timing to trigger race condition in shared resource access. Remote exploitation not possible.

Real-world risk is moderate despite the 7.0 CVSS score. The attack vector is local-only (AV:L) requiring authenticated access (PR:L), limiting exposure to scenarios where attackers already have user-level access via phishing, malware, or insider threats. High attack complexity (AC:H) means exploitation is not trivial and may require multiple attempts or specific timing conditions. No public exploit code exists and the vulnerability is not in CISA KEV, indicating no confirmed active exploitation. EPSS data not provided, but race conditions typically have lower exploitation probability until proof-of-concept code circulates. From an SSVC perspective: exploitation status is none, automatable is no (requires local access and timing precision), technical impact is total (full privilege escalation to SYSTEM). This is a legitimate concern for multi-user systems, terminal servers, and environments with untrusted local users, but lower priority than remotely exploitable vulnerabilities. Patch deployment should follow standard cycles unless specific threat intelligence indicates targeting.

An attacker with standard user credentials on a Windows corporate workstation executes a malicious program that repeatedly calls Function Discovery Service APIs while simultaneously manipulating shared resources. By winning the race condition through precise timing or brute-force attempts, the attacker injects code into the elevated service context, achieving SYSTEM privileges and gaining full control over the machine to install backdoors, disable security software, or access sensitive corporate data.