Windows Work Folders CVE-2026-61349

Exploitation requires an authorized (authenticated) local user account on the target system - the CVSS vector PR:L confirms low-privilege local authentication is sufficient, with no additional administrative rights needed. The Windows Work Folder Service (SyncShareSvc) must be running and active on the target host; systems where this service is disabled or not installed are not affected. No user interaction from a victim is required (UI:N). Exploitation is constrained by the race condition timing requirement, meaning the attacker must control thread scheduling or repeatedly attempt the trigger to win the race - this limits automated mass exploitation (SSVC: Automatable: no). Exploitation is further limited to local access only (AV:L); no network-based attack path exists from available data. The vulnerability cannot be exploited remotely without a prior foothold on the target system.

The CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects full confidentiality, integrity, and availability impact achievable by a low-privileged local user. However, the CWE-362 race condition classification and the SSVC 'Automatable: no' designation are significant moderating factors - reliable exploitation typically requires precise timing control, making mass automated attack campaigns difficult. The SSVC 'Exploitation: none' rating corroborates the absence of observed in-the-wild exploitation. EPSS data was not provided in source intelligence, so probabilistic exploitation likelihood cannot be quantified. The 'Denial of Service' tag suggests that failed exploitation attempts may result in service crashes, which is a secondary risk. The assigned AC:L in the official CVSS vector understates the difficulty implied by the race condition root cause; defenders should treat AC as effectively higher in practice. Overall, this is a genuine medium-priority post-exploitation or insider-threat vector rather than a remote mass-exploitation risk - the true priority rises significantly for environments where lateral movement or privilege escalation chains are a concern.

A low-privileged domain user with an interactive or remote desktop session on a Windows Server 2022 host runs a specially crafted local process that triggers a race condition between two threads in the Work Folder Service, causing a use-after-free memory corruption. By controlling the freed memory region's reuse, the attacker redirects execution flow within the service, achieving code execution at SYSTEM privileges and gaining full administrative control over the host. No public exploit code has been identified at time of analysis, and successful exploitation requires winning the race condition, making reliable exploitation more difficult than the AC:L CVSS metric suggests.