Windows Security Health CVE-2026-78457

Requires an authenticated local session on the target system - the attacker must be able to log in interactively or via RDP with at minimum a standard (low-privilege) user account (PR:L). Attack complexity is high (AC:H): successful exploitation depends on winning a memory race condition, making it probabilistic and requiring repeated attempts or precise heap-grooming techniques. No user interaction by a privileged user is required after the attacker has their session. The vulnerability is confined to Windows 11 (24H2, 25H2, 26H1) and Windows Server 2022/2025 at affected build levels - fully patched systems are not affected. No network-facing trigger has been described; AV:L confirms the exploit cannot be delivered remotely without prior authenticated access.

The CVSS 3.1 base score of 7.0 with vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H appropriately reflects the primary risk envelope: local access is mandatory, exploitation complexity is high (typical for UAF race-condition exploitation requiring precise heap manipulation), and a low-privilege authenticated account is the minimum bar. Once successful, the impact is total (C:H/I:H/A:H) because the target service runs as SYSTEM. No CISA KEV listing and no public proof-of-concept are known at time of analysis, making mass exploitation unlikely in the short term. EPSS data is not provided; however, given AC:H and AV:L constraints, opportunistic automated exploitation is implausible - threat actors would need to invest in custom exploit development. The real-world priority should be elevated for multi-user environments (terminal servers, VDI, shared workstations) where untrusted local users are a realistic attacker model. Single-user endpoints where physical access implies trust can treat this as lower urgency but should still patch on the normal monthly cadence.

A standard domain or local user account on a Windows Server 2025 terminal server logs in via RDP, then runs a crafted binary that repeatedly triggers a race condition in the Security Health Service to corrupt freed heap memory. By controlling heap layout, the attacker redirects execution to shellcode running in the service's SYSTEM context, gaining full administrative control of the server. No public exploit code is currently known, meaning this scenario requires bespoke exploit development targeting the specific UAF primitive.