Windows Cryptographic Services CVE-2026-40377

Exploitation requires the attacker to already have local, authenticated access to the target host at low privilege (CVSS PR:L, AV:L) - this is a local privilege-escalation flaw, not a remotely reachable one, so an attacker must first obtain a foothold such as a standard user account or a compromised low-privilege process. No user interaction is required (UI:N) and attack complexity is low (AC:L), meaning once local access exists, triggering the heap overflow in Cryptographic Services is straightforward against affected default Windows installations with no special feature toggle or non-default configuration needed. The principal limiting factors are the mandatory local access and low-privilege authentication; hosts where untrusted users cannot log in locally (single-admin workstations without shared access) present a much smaller realistic attack surface than multi-user servers, terminal/RDS, and jump hosts.

Signals are internally consistent and point to a moderate, post-compromise risk. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8 HIGH) requires local access and at least low privileges, with high impact to confidentiality, integrity, and availability once triggered. EPSS is very low (0.04%, 13th percentile) and SSVC records Exploitation: none and Automatable: no, so mass or automated exploitation is not currently expected; however SSVC Technical Impact: total aligns with the C:H/I:H/A:H rating, confirming that successful exploitation yields full system control. There is no CISA KEV listing and no evidence of a public POC, so this is a real but non-urgent priority: it matters most as a chained escalation step after an attacker already has a foothold, not as a standalone remotely exploitable flaw. No key signals conflict - the CVSS local vector, low EPSS, and SSVC 'no automation' assessment all agree this is targeted-use escalation rather than a wormable threat.

An attacker who has already gained a limited foothold on a Windows host - for example a standard domain user account, a compromised low-privilege service, or access to a shared terminal server - invokes a crafted operation against Windows Cryptographic Services that overflows a heap buffer, corrupting memory to elevate to SYSTEM. From there they disable security tooling, harvest credentials, and move laterally. No public exploit is identified at time of analysis, and the local attack vector with low complexity means a working exploit would be reliable but requires the attacker to already be on the machine.