Windows CSC Driver CVE-2026-70149

Per the NVD/MSRC description, exploitation requires an authorized (logged-on) attacker with local access to a Windows system running the Client Side Caching / Offline Files driver (csc.sys), which is present and active by default across supported Windows client and server editions. The attacker must be able to invoke the vulnerable driver code path to trigger the heap over-read. Limiting factors: the description indicates local access and existing authorization are needed, bounding this to attackers who already have a foothold or valid credentials on the host - substantially narrowing exposure versus a true remote-unauthenticated flaw. Caveat: the input CVSS vector lists AV:N/PR:N/UI:R, which if accurate would instead require tricking a user into interacting with attacker-controlled content (e.g., a malicious network share) rather than prior local authorization; this discrepancy should be resolved against the vendor advisory.

Signals conflict sharply and must be reconciled before prioritization. The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.8) describes a remote, unauthenticated, user-interaction-driven flaw with full confidentiality, integrity, and availability impact - but the NVD/MSRC description explicitly says 'an authorized attacker' can 'disclose information locally,' which implies a local vector (AV:L), required privileges (PR:L), and confidentiality-only impact. This CVSS-vs-description divergence should be verified with Microsoft's MSRC advisory. CWE-122 (heap-based buffer overflow) and the 'Buffer Overflow/Heap Overflow' tags further suggest memory corruption rather than pure information exposure, hinting the overflow is the mechanism by which adjacent heap memory is leaked. CISA SSVC data is the clearest de-prioritizing signal: Exploitation=none, Automatable=no, Technical Impact=total - meaning no observed exploitation and no mass/scripted exploitation path, though a successful attack yields total technical impact. There is no CISA KEV listing and no EPSS score provided, and no public exploit code is referenced. Net assessment: despite a high 8.8 CVSS, realistic risk is moderate - exploitation requires local/authorized access per the description, there is no evidence of exploitation or automation, and a patch is already available. This is a patch-in-normal-cycle item for most environments rather than an emergency, but the ubiquity of Windows and the 'total' technical impact warrant timely remediation.

A local, authorized user on a Windows host triggers a heap-based buffer overflow in the Client Side Caching driver (csc.sys), causing the driver to over-read and leak sensitive kernel/heap memory contents to the attacker. No public exploit code is identified at time of analysis, and CISA SSVC lists exploitation as none. Note: the input CVSS vector implies a network/user-interaction path, so if that vector is accurate the delivery could instead involve luring a user to a malicious offline-files/SMB share.