Windows Function Discovery CVE-2026-42836

Requires an authenticated low-privileged local session on the target Windows host (CVSS PR:L, AV:L) and the ability to invoke Function Discovery operations that exercise the WSD provider (fdwsd.dll), which depends on the Function Discovery Provider Host service being running - the default state on Windows client SKUs and on Server SKUs where Network Discovery is enabled. Exploitation is limited by CVSS AC:H, meaning the attacker must reliably win a timing race against a concurrent thread in fdwsd.dll, typically requiring many attempts and tolerance for crashes; no user interaction is required (UI:N) and no network access is needed. Hosts that have disabled Network Discovery and stopped the fdPHost/FDResPub services materially reduce attack surface.

The CVSS vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H indicates a local, high-complexity, low-privileged attack with full CIA impact and unchanged scope - a realistic but not trivial elevation-of-privilege path. AC:H is meaningful here: the attacker must repeatedly hit a narrow timing window in fdwsd.dll, which typically translates to spraying threads, looping a discovery operation, and tolerating many failed attempts before success. No EPSS score, SSVC decision, KEV listing, or public POC was supplied with this CVE, so exploitation probability cannot be quantified; based on signals available this is no public exploit identified at time of analysis. The vendor-assigned Information Disclosure tag is mildly inconsistent with the CWE-362 EoP framing in the description - defenders should treat the MSRC advisory as canonical and verify whether disclosure or EoP is the primary impact. Overall this should be patched on standard Patch Tuesday cadence on multi-user systems and ahead of cadence on shared/jump hosts where low-privileged users already have a foothold.

A standard domain user with an interactive or remote shell session on a Windows host (e.g., a Remote Desktop Services jump server, Citrix host, or developer workstation) launches a small tool that repeatedly triggers WSD discovery operations through Function Discovery while a second thread mutates the shared resource that fdwsd.dll references. After many iterations the attacker wins the race, corrupts service state, and pivots to executing attacker-controlled code in the context of the Function Discovery service to escalate to SYSTEM. No public exploit identified at time of analysis, but CWE-362 EoPs in Windows service DLLs have a well-established exploitation pattern.