Windows Authentication Methods CVE-2026-73005

Exploitation requires an authorized (low-privilege) account with local logon capability on the target Windows system - matching the CVSS PR:L/AV:L metrics. The attacker must be able to execute code locally, either via interactive logon, Remote Desktop, or another code execution primitive. High attack complexity (AC:H) reflects that winning the race condition requires precise timing, potentially limiting reliable exploitation to scenarios with attacker-controlled concurrency. No special Windows features or non-default configurations are described as prerequisites; the vulnerability resides in a core authentication component present in all affected builds. Exploitation is limited by: requirement for local code execution, AC:H timing window that makes reliable exploitation harder to automate, and absence of a known public exploit at time of analysis.

The CVSS 3.1 vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H yields a base score of 7.0, reflecting that exploitation requires local access, low-privilege credentials, and a high-complexity race-condition timing window - all of which meaningfully constrain real-world risk. EPSS data is not provided in this submission, limiting probabilistic exploitation forecasting. No KEV listing and no public POC are identified, consistent with the AC:H rating suggesting exploitation is not trivially automatable. However, race-condition UAFs in Windows authentication paths are historically high-value targets for post-compromise lateral movement and persistence scenarios where an attacker already holds a foothold account. The breadth of affected Windows versions (15 distinct OS/version combinations) amplifies aggregate exposure. Real-world priority is best characterized as medium-high for environments with untrusted local users (shared workstations, VDI, terminal servers, developer machines) and lower for systems with tight local access controls. The 'Denial of Service' tag in the input metadata does not match the description, which exclusively describes privilege escalation - this discrepancy should be noted but does not affect the CVSS-based risk assessment.

An attacker with a low-privileged local account on a vulnerable Windows system (e.g., a shared workstation user, a compromised service account, or an RDP session) launches concurrent threads that race to invoke Windows authentication APIs. By timing requests to free and subsequently access the same authentication object, the attacker wins the race condition, corrupts the freed memory region with attacker-controlled data, and redirects execution to achieve SYSTEM-level code execution. No public proof-of-concept has been identified, but the technique is consistent with well-understood post-exploitation privilege escalation patterns used in ransomware and APT campaigns.