Windows File History CVE-2026-68837

The attacker must have an authenticated local session on the target system - any standard domain or local user account satisfies the PR:L prerequisite. The Windows File History Service must be present and running, which is its default state on Windows 10 and 11 desktop editions when File History is enabled; the feature may be absent or disabled on some Server Core configurations. High attack complexity (AC:H) indicates a timing- or race-condition-dependent trigger, meaning exploitation is not trivially reliable and may require multiple attempts. There is no requirement for user interaction. Exploitation is limited to the local system scope (S:U); network-only access does not satisfy AV:L unless combined with a remote shell or RDP session that provides local code execution.

Real-world risk is moderate-to-high in environments where untrusted local users exist - for example, shared workstations, terminal servers, or VDI fleets. The AC:H metric signals that reliable exploitation requires specific timing or environmental conditions, typical of race-condition-driven UAF bugs, which limits commodity exploitation. EPSS data was not provided; without it, broad probabilistic exploitation rate cannot be stated. No KEV listing and no public POC are confirmed, indicating this has not yet seen broad in-the-wild abuse. However, the full C:H/I:H/A:H triad and PR:L prerequisite (any domain or local user) mean that a working exploit, if developed, would be impactful and accessible to a wide attacker pool on any unpatched Windows system. Priority should be elevated for environments with shared local access or remote desktop exposure.

A low-privilege domain or local user logs into a vulnerable Windows workstation and runs a crafted process that races the File History Service's memory-allocation and deallocation routines to trigger a use-after-free condition. By winning the race and shaping heap layout, the attacker redirects execution to attacker-controlled code running within the service's elevated context. No public POC has been identified, making reliable exploitation currently dependent on custom tooling.