Windows Work Folders CVE-2026-80075

Exploitation requires a locally authenticated session with at minimum a low-privileged (standard user) account on the target Windows 10 or Windows 11 system, as reflected in the CVSS AV:L/PR:L vector. The Windows Work Folders feature must be installed and active on the endpoint - Work Folders is an optional enterprise component, typically enabled via Group Policy in organizations using Work Folders sync servers, and is not universally deployed across all Windows installations. No secondary user interaction is required (UI:N), and attack complexity is Low, implying no special timing, race conditions, or environmental prerequisites beyond an active Work Folders configuration. Remote unauthenticated exploitation is not possible. Environments where Work Folders is disabled or not configured are not affected by this vulnerability.

The CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately captures the privilege escalation profile: local access with a standard user account, low attack complexity, no user interaction, and full CIA impact on the vulnerable system. The AC:L rating is significant - it implies reliable, repeatable exploitation without race conditions or timing constraints. No EPSS score was provided in the input, and no CISA KEV listing exists, suggesting active exploitation is not yet confirmed at scale. No public POC has been identified. Despite the lack of a network vector, local privilege escalation primitives on widely-deployed Windows versions represent meaningful post-exploitation value; they are routinely chained after initial access (phishing, web exploitation, RCE) to achieve SYSTEM persistence. Risk is elevated in environments where Work Folders is actively deployed and endpoints are not promptly patched with cumulative updates. The patch is confirmed available from Microsoft, making patch cadence the primary risk variable.

An attacker who has obtained a standard user session on a Windows 10 or 11 endpoint - via phishing, credential theft, or lateral movement - invokes a crafted interaction with the Windows Work Folders synchronization component that triggers a heap buffer overflow in a privileged process. The corrupted heap memory redirects execution, granting the attacker SYSTEM-level privileges, enabling persistence, credential harvesting, or lateral movement. No public exploit code has been identified, but the AC:L rating indicates exploitation would be straightforward for a skilled attacker once local access is established.