EUVD-2026-44314
GHSA-6q58-22x4-6rcv
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Local-only UAF in a privileged service requires an authenticated low-priv account (PR:L) and a race win (AC:H); success yields full local C/I/A compromise.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Use after free in Windows Client-Side Caching (CSC) Service allows an authorized attacker to elevate privileges locally.
AnalysisAI
Local privilege escalation in the Microsoft Windows Client-Side Caching (CSC) Service, driven by a use-after-free (CWE-416) memory-corruption flaw affecting Windows 10 (1607 through 22H2), Windows 11 (24H2/25H2/26H1), and Windows Server 2012 through 2025. An authorized attacker who already holds low-level privileges (PR:L) on the host can trigger the freed-object reuse to gain elevated, likely SYSTEM-level, privileges. The issue was reported by Microsoft with a patch available; there is no public exploit identified at time of analysis and no CISA KEV listing.
Technical ContextAI
The Client-Side Caching (CSC) Service underpins Windows Offline Files, caching network share (SMB) content locally so users can access it when disconnected; it runs as a privileged system component (cscsvc). The root cause is a use-after-free (CWE-416): the service continues to reference a heap object after it has been freed, allowing the freed memory to be reallocated and controlled by an attacker before the dangling pointer is dereferenced. Successful control of that reused allocation lets attacker-influenced data be treated as a valid object, yielding code execution in the service's security context. The CPE data confirms the affected surface is the operating system itself across a broad range of client and server SKUs (Windows 10 1607/1809/21H2/22H2, Windows 11 24H2/25H2/26H1, and Windows Server 2012/2012 R2/2016/2019/2022/2025, including Server Core installations).
RemediationAI
Apply the Microsoft security update for CVE-2026-58637 (Patch available per vendor advisory) for each affected SKU via Windows Update / WSUS / your patch-management tooling; the authoritative fix and per-SKU KB numbers are published at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58637. Because exact fixed build/KB versions were not included in this dataset, pull them from that MSRC page rather than assuming a version. As a compensating control where patching must be delayed and Offline Files is not required, disable the Offline Files / CSC feature (via Group Policy 'Allow or Disallow use of the Offline Files feature' or Sync Center), which removes the vulnerable service's exposure at the cost of losing offline access to network shares for roaming or intermittently-connected users. Since exploitation requires an authenticated local foothold (PR:L), also tighten local access - limit interactive/low-privilege logon rights on servers and enforce least privilege on endpoints - to reduce the pool of principals who could trigger the flaw.
More in Windows 10 Version 1607
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to run arbitr
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem
Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating
Remote code execution in Microsoft Windows Remote Desktop (RDP) allows an unauthorized network attacker to run arbitrary
Same weakness CWE-416 – Use After Free
View allSame technique Use After Free
View allShare
External POC / Exploit Code
Leaving vuln.today