Windows MDM CVE-2026-73003

The attacker must have a low-privileged authenticated local session on the target Windows system (PR:L). The Windows MDM client component must be active, which is the default state on enterprise-managed endpoints enrolled via Microsoft Intune, SCCM, or similar MDM platforms; standalone unmanaged machines may have reduced exposure depending on MDM service state. The attack complexity is rated high (AC:H), meaning the attacker must win a timing-dependent race condition or precisely engineer heap layout - exploitation is not reliable without a purpose-built payload. No user interaction is required once the attacker has local session access. Remote unauthenticated exploitation is not possible given AV:L.

The CVSS 7.0 score (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects a locally constrained but high-impact vulnerability - an authenticated local user can potentially escalate to SYSTEM-level access with no user interaction required. The AC:H metric significantly tempers real-world risk: exploitation requires successfully engineering a race condition or specific heap state, which reduces automated/scripted mass exploitation probability. No KEV listing and no reported POC reduce immediate urgency. EPSS data is not provided, so exploitation probability cannot be quantified. However, Windows LPE UAF primitives are well-understood by exploit developers, and MDM is an always-running, privileged Windows service - once a reliable heap grooming primitive is found, AC:H barriers can often be overcome. This is best treated as a medium-urgency patch priority: patch in the next scheduled maintenance cycle, but escalate immediately if threat actor activity targeting Windows LPE is observed. The 'Denial Of Service' tag in the input metadata does not reflect the primary described impact; this is a privilege escalation vulnerability.

A low-privileged local user (e.g., a standard domain account or a compromised service account) on an MDM-enrolled Windows endpoint executes a crafted local process that triggers a race condition in the MDM service, causing a heap allocation to reuse freed MDM object memory. By controlling the reused heap region's content, the attacker redirects execution to their shellcode or ROP chain, escalating to SYSTEM privileges and achieving full host compromise. No public exploit code has been identified at time of analysis.