Modern Execution Server CVE-2026-72963

Exploitation requires an authenticated low-privilege local session on the target Windows system (PR:L, AV:L). The attacker must be able to execute code in a user context - a guest or standard user account suffices. The AC:H metric indicates a race condition or precise heap state is required, meaning exploitation is not reliably one-shot and may require multiple attempts or careful memory grooming. No specific non-default feature or configuration setting is identified as a prerequisite; the vulnerable component (Modern Execution Server) appears to be a standard Windows subsystem active in default configurations. Exploitation is limited to the local system and does not provide any network-facing attack surface; a remote attacker must first obtain a local session (e.g., via phishing, RDP, or another initial-access vulnerability) before this flaw becomes exploitable.

The CVSS 3.1 base score of 7.0 reflects genuine, well-calibrated risk: AV:L limits exposure to already-present local attackers, AC:H acknowledges the exploitation complexity inherent in UAF races, and PR:L correctly requires an authenticated low-privilege session. The C:H/I:H/A:H impact triple reflects that successful LPE to SYSTEM yields full system compromise. No public exploit code or active exploitation via CISA KEV is confirmed, which meaningfully reduces immediate real-world priority compared to weaponized LPE flaws. EPSS data was not provided; given AC:H and no known public PoC, probability of widespread automated exploitation is low. However, this class of vulnerability (Windows LPE via kernel/system component UAF) is historically attractive to ransomware operators and APTs for post-compromise privilege escalation, so treating this as a medium-priority patch for any internet-exposed or multi-tenant Windows estate is prudent. The 'Denial Of Service' tag in the input metadata is misleading - the vendor description and CVSS impact metrics indicate LPE as the primary impact, not DoS.

An attacker with a low-privilege user session on a target Windows host sends crafted requests to the Windows Modern Execution Server component, triggering a race condition that causes the server to operate on freed memory. By winning the race and influencing the reclaimed heap region - for example via heap spray or careful allocation sequencing - the attacker redirects execution to attacker-controlled code running as SYSTEM, achieving full local privilege escalation. No public proof-of-concept is confirmed, and the AC:H requirement makes reliable exploitation non-trivial without a well-developed exploit.