Windows SMB Client CVE-2026-40410

Exploitation requires the attacker to already hold a valid local, low-privileged account on the target Windows host (CVSS PR:L, AV:L) and to run code locally that exercises the Windows SMB Client redirector to reach the freed object; no network exposure and no user interaction are needed (UI:N). Exploitation is limited by high attack complexity (AC:H): the use-after-free is a race/timing-dependent condition the attacker must win to achieve elevation rather than a crash, which is why CISA SSVC marks it non-automatable. It applies to the specific unpatched Windows builds listed above; hosts already at the fixed build numbers are not affected.

Multiple signals agree this is a real but non-urgent local escalation. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0) shows the attacker must already have code execution as a low-privileged user on the box (AV:L, PR:L) and must win a race or meet a hard-to-control condition (AC:H) typical of use-after-free bugs, but the payoff is full confidentiality/integrity/availability compromise. EPSS is only 0.04% (12th percentile) and CISA SSVC records Exploitation: none and Automatable: no, while Technical Impact is total - consistent with a high-impact-but-hard-to-weaponize memory-corruption primitive. The vulnerability is NOT in CISA KEV. These signals do not conflict: high impact, low probability, not currently exploited. Note the vendor Tags include 'Denial Of Service' alongside 'Use After Free/Memory Corruption', which is broadly consistent with a UAF (crash-or-elevate), though the CVE title emphasizes privilege elevation - a race that fails typically yields a bugcheck rather than clean EoP.

An attacker who has already gained a foothold as an unprivileged user - for example via phishing or a compromised service account - runs a local program that drives the SMB client in a way that triggers the use-after-free, then grooms the kernel heap to reclaim the freed object and corrupt privileged memory. Winning the timing race (CVSS AC:H) yields SYSTEM-level code execution; losing it typically crashes the host. No public proof-of-concept has been identified at time of analysis.