Windows Storage CVE-2026-58526

Exploitation requires the attacker to already have local, authenticated access with at least low privileges on the target (CVSS PR:L, AV:L) and the ability to execute a crafted local program; no user interaction is needed (UI:N). It cannot be triggered remotely or over the network, which is the primary limiting factor. It applies to default installations of the listed Windows 10/11 and Windows Server 2019/2022/2025 builds - no special feature toggle or non-default configuration is called out in the description - so the main constraints are the local-access prerequisite and the need to reliably win the use-after-free race via heap grooming.

Signals are internally consistent and point to a moderate-priority local EoP rather than a mass-exploitation emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U, C:H/I:H/A:H, base 7.8) shows local access with low existing privileges and no user interaction, yielding total impact on the affected system. SSVC reinforces this: Exploitation 'none', Automatable 'no' (an attacker must already have a foothold and run local code), but Technical Impact 'total'. EPSS is low at 0.15% (5th percentile) and the flaw is NOT on CISA KEV, so there is no evidence of active or automated exploitation. This is a real 'chain-completion' primitive - valuable to attackers who already have code execution and need SYSTEM - but not a remotely wormable, drive-by threat. Because it is a Microsoft-reported Patch-Tuesday-class fix, standard patch cadence is appropriate; no signal conflicts were identified.

An attacker who already has a low-privileged foothold on a Windows host - for example through a phished user account or a compromised low-privilege service - runs a crafted local program that triggers the use-after-free in Windows Storage, grooms the freed allocation, and hijacks the dangling reference to execute code with SYSTEM privileges. No public exploit is identified at time of analysis, and the attack requires local execution rather than remote delivery.