Windows CSC Service CVE-2026-58637

Exploitation requires an already-authenticated local presence on the target: the CVSS vector is AV:L (no remote/network trigger) and PR:L (a valid low-privileged local account is needed), with UI:N (no victim interaction). The attacker must reach and drive the Client-Side Caching (CSC) Service - i.e. the Offline Files feature/cscsvc must be present and reachable, which it is by default on the listed Windows client and server SKUs. What limits exploitation: AC:H means success depends on winning a race condition / achieving a specific heap state to reuse the freed object, so exploitation is not reliably one-shot; and if the Offline Files/CSC feature is disabled by policy, the attack surface is removed. No remote or unauthenticated path exists.

This is a moderate-severity, patch-now-on-normal-cadence issue rather than a fire-drill. The CVSS 3.1 base score of 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects meaningful impact (full C/I/A on the local system) but constrained exploitability: the attacker must already be authenticated on the host (PR:L) and the high attack complexity (AC:H) is consistent with a use-after-free that depends on winning a race or grooming the heap into a specific state, which reduces reliability. No EPSS score, KEV entry, or POC was provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation - signals that argue against emergency prioritization. The main caveat: use-after-free EoP bugs in core Windows services are historically attractive to attackers as a post-compromise privilege escalation primitive, so the low current exploitation signal could change once patch-diffing occurs. No conflicting data was observed; the CVSS local vector aligns with the description's 'elevate privileges locally' language.

An attacker who has already gained a low-privileged foothold on a Windows host (for example, via phishing or a compromised standard user account) invokes the Client-Side Caching service and races its object lifecycle to trigger the use-after-free, reallocating the freed memory with attacker-controlled data. Because AC:H, the exploit likely needs multiple attempts to win the timing/heap-grooming race, but on success it elevates the attacker to the service's privileged (SYSTEM-level) context. No public POC was identified at time of analysis.