Windows Clip Service CVE-2026-50384

Exploitation requires the attacker to already have valid low-privileged local access to the target (PR:L, AV:L) and the ability to run code that interacts with the Windows Clip Service (cbdhsvc); no user interaction is needed (UI:N). The exploit is gated by a timing-dependent race condition (AC:H), so the attacker must repeatedly attempt to win a narrow synchronization window, and success is probabilistic rather than guaranteed. Limiting factors: it cannot be triggered remotely or by an unauthenticated attacker, it requires the clipboard/Clip Service functionality to be reachable in the attacker's session, and disabling clipboard history / cloud clipboard reduces the attack surface. The affected component is present by default across the listed Windows 10, Windows 11, and Windows Server 2019-2025 builds.

The CVSS 3.1 base score is 7.0 (High) with vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - local vector, high attack complexity, low privileges required, no user interaction, unchanged scope, and high impact across confidentiality, integrity, and availability. The high attack complexity (AC:H) is significant: race conditions are inherently non-deterministic and the attacker must reliably win a timing window, which lowers real-world exploitability compared to a deterministic bug of the same score. This is a local-only EoP requiring an existing foothold (PR:L), so it is a post-compromise escalation primitive rather than an initial-access or remotely-reachable flaw. No EPSS score was provided in the input, and the vulnerability is not in CISA KEV and has no identified public exploit, so there is no evidence of active or imminent widespread exploitation. Net assessment: a genuine but second-stage risk best prioritized within normal Patch Tuesday cycles for high-value or multi-user hosts (terminal servers, shared workstations), not an emergency; the 'Information Disclosure' tag conflicts with the EoP description and should be verified against the Microsoft advisory.

An attacker who has already gained low-privileged code execution on a Windows host - for example via phishing, a compromised user account, or a malicious insider - runs a tool that repeatedly races operations against the Clip Service to hit the unsynchronized window. On a successful race, the attacker manipulates the shared resource to have privileged code act on attacker-controlled state, elevating from a standard user to higher privileges and gaining full control impact. No public exploit is identified at time of analysis, and the high attack complexity means the exploit may require many attempts to succeed reliably.