Windows Runtime CVE-2026-58527

Exploitation requires the attacker to already have local, authenticated access with low privileges (PR:L) and the ability to execute code on the target host; no user interaction is needed (UI:N). The concrete prerequisite is the ability to run concurrent operations against the vulnerable Windows Runtime shared resource and to win a timing-dependent race window - this is what makes complexity high (AC:H). Limiting factors: it is not remotely reachable (AV:L, no network vector), it cannot be triggered by an unauthenticated attacker, exploitation is non-deterministic and may require many attempts, and SSVC assesses it as not automatable - so realistic risk is highest on shared/multi-user systems (terminal servers, Server Core hosts running untrusted workloads) and lower on single-user endpoints where an attacker with local code execution already has substantial control.

Signals are largely consistent and point to a real-but-not-urgent priority. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0) requires local access, low privileges, and - critically - high attack complexity (AC:H) because winning a race window is timing-dependent and not deterministic. SSVC aligns: Exploitation=none (no observed or public exploit), Automatable=no (cannot be reliably scripted at scale), but Technical Impact=total (full compromise of the local system if won). EPSS of 0.24% (16th percentile) reinforces low near-term exploitation likelihood. There are no conflicting signals here: this is a high-impact-if-exploited local EoP that is hard to weaponize reliably, so it is a routine-to-important patch (typical Patch-Tuesday EoP) rather than an emergency. Note: the CVE tags list 'Information Disclosure' while the description and CVSS describe privilege elevation with full C/I/A impact - treat the primary impact as local privilege escalation per the description and vector.

A local attacker who has already obtained low-privileged code execution - for example via a phishing payload or a compromised standard user account - runs a program that repeatedly triggers the vulnerable WinRT operation from multiple threads to hit the unsynchronized shared-resource window. On a successful race they corrupt or substitute the shared object as a privileged path consumes it, elevating to SYSTEM and achieving full local compromise. No public proof-of-concept has been identified, and the high timing sensitivity (AC:H) means the attacker may need many attempts to win the race.