Windows WebClient Service CVE-2026-72965

The attacker must have an existing authenticated local session on the target Windows machine - any standard (non-privileged) user account suffices, matching CVSS PR:L. The WebClient service must be running; it is enabled by default on Windows desktop editions but may be disabled on some Server hardened configurations. No network access to the target is required beyond initial foothold - the exploit is purely local (AV:L). No specific non-default configuration is required on desktop Windows. On Server editions where WebClient is disabled by default, an attacker or installer that re-enables the service would create the prerequisite. No user interaction (UI:N) and no elevated startup privileges are needed - a standard domain user shell is sufficient.

With a CVSS 3.1 score of 7.8 (High) and a vector of AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, this is a classic high-priority local privilege escalation. The attack complexity is Low and no user interaction is required, meaning once an attacker obtains any foothold on a system (phishing, web exploit, initial-access malware), they can reliably escalate to SYSTEM without further environmental conditions. The breadth of affected versions - spanning legacy Server 2012 to the latest Server 2025 and Windows 11 26H1 - makes this a high-priority patch across virtually any Windows environment. No KEV listing and no public exploit have been identified at time of analysis; EPSS data was not provided. However, LPE vulnerabilities in core Windows services with low-complexity vectors are routinely weaponized by threat actors post-initial-access and integrated into exploit kits within weeks of public disclosure. The 'Denial of Service' tag in the input metadata appears mislabeled - the vendor-confirmed impact is privilege escalation, not denial of service. The A:H in CVSS reflects that post-exploitation the attacker has full control, not that DoS is the primary impact.

An attacker who has gained initial access to a Windows endpoint - via phishing, a web exploit, or a compromised VPN credential - and is running as a standard domain user triggers a use-after-free condition in the WebClient service by sending a crafted sequence of requests that causes the service to access a freed memory allocation. By controlling the heap layout to place attacker-supplied data in the reclaimed region, the attacker redirects the service's execution flow and executes arbitrary code at SYSTEM privileges, achieving full host compromise without requiring any additional user interaction. No public exploit code has been identified at time of analysis, but the AC:L rating indicates the technique is not technically complex once the UAF trigger is understood.