Windows File History CVE-2026-71340

Exploitation requires a locally authenticated account with standard (low-privileged) user rights and interactive logon access to the target system - remote exploitation is not possible per the AV:L CVSS metric. The Windows File History Service must be present and active; it is enabled by default on Windows 10 and Windows 11 workstation editions but may be absent or stopped on Server installations where File History is not configured. The AC:H metric indicates that successful exploitation additionally requires achieving a specific heap memory state, likely through precise allocation sequencing or race-condition timing - this is a concrete technical barrier that distinguishes this from trivially automatable EoP bugs. No special application configuration or non-default feature beyond local user access and the File History Service being active is required. Exploitation is limited to physical or remote-desktop sessions - purely remote network-based exploitation is not applicable.

The CVSS 7.0 score with AV:L/AC:H/PR:L correctly positions this as a meaningful but not trivially exploitable local privilege escalation. The local-only attack vector significantly limits exposure compared to network-reachable vulnerabilities - an attacker must already have interactive access to the target system. The high complexity metric reflects genuine exploit development difficulty: UAF exploitation requires careful heap grooming and is not reliably achievable without dedicated effort and target-specific knowledge. EPSS data is absent from the input, making probabilistic exploitation forecasting unavailable; however, UAF techniques are well-documented in public exploit literature and skilled threat actors regularly achieve reliable UAF exploitation given sufficient analysis time. No CISA KEV listing and no public exploit code exist at time of analysis. Even a mid-sized municipal IT team in boleslawiec maintaining a mixed Windows 10/11 fleet should treat this as a routine patch-cycle priority rather than an emergency - the AC:H bar moderates urgency relative to AC:L privilege escalation bugs, but the full C:H/I:H/A:H impact upon success and the ubiquitous Windows footprint sustain meaningful residual risk for any delayed patching.

A low-privileged user with interactive logon access to an unpatched Windows 10 or Windows 11 workstation identifies the File History Service process and crafts a sequence of memory allocation and deallocation operations designed to achieve a specific heap layout. After triggering the use-after-free condition - likely requiring multiple attempts to achieve reliable timing - the attacker redirects execution to controlled memory and gains SYSTEM-level privileges, then installs a persistent backdoor or dumps LSASS credentials for lateral movement. No public exploit code has been identified, meaning this scenario currently demands significant exploit-development expertise.