Windows SSTP CVE-2026-72930

The attacker must have an existing authenticated session on the target Windows system - a low-privileged local or remote-interactive (e.g., RDP) account satisfies PR:L. The SSTP component must be present and active; SSTP is included in all supported Windows editions by default, though active exploitation likely requires the service to be handling or reachable from attacker-controlled input. The high attack complexity (AC:H) means a specific memory-timing condition or race must be won - exploitation is not reliably one-shot and may require repeated attempts or precise heap manipulation. Exploitation is bounded to the local system (AV:L); no network-remote path is indicated by the CVSS vector. Limiting factors include the need for an existing low-privileged account, the AC:H race requirement, and the absence of any confirmed public exploit or automated tooling.

The CVSS 7.0 score with vector AV:L/AC:H/PR:L reflects a bounded but meaningful local privilege-escalation scenario: the attacker must already be logged on with a standard account and must win a race or satisfy memory-state preconditions. EPSS data is not provided, and neither CISA KEV inclusion nor public proof-of-concept code has been reported, indicating no confirmed widespread exploitation at time of analysis. The high C/I/A impact scores are consistent with a successful UAF exploit yielding full system control, yet the AC:H modifier meaningfully reduces the practical exploitability compared to trivially reliable flaws. The breadth of affected builds - from end-of-life Server 2012 through current Server 2025 - is noteworthy: even a mid-sized municipal IT team in walbrzych running heterogeneous Windows Server versions would face an exposure on unpatched systems shared by multiple lower-privileged users or remote-desktop operators. The local-only attack vector significantly limits remote exploitation but makes this relevant in RDP-heavy, terminal-server, or cloud VDI deployments where multiple untrusted users share a system. Priority should be moderate-to-high for multi-user Windows environments; lower for single-user desktops with no SSTP exposure.

An attacker with a standard (low-privileged) user account on a Windows Server acting as a multi-user terminal server or RDP gateway triggers a race condition in the SSTP component that frees a memory object and immediately re-uses it with attacker-controlled data. On a successful heap-spray or timing win satisfying the AC:H condition, the dangling pointer dereference executes attacker-supplied shellcode with elevated privileges, resulting in full system compromise. No public proof-of-concept has been identified, making reliable exploitation non-trivial but not impossible for capable threat actors.