Windows Setup Cleanup CVE-2026-83505

Requires an authenticated, low-privileged local account (PR:L) on the Windows host and the ability to run code that interacts with the Windows Setup Files Cleanup operation. The core prerequisite is winning the TOCTOU race window between the component's file/path validation and its use - a timing-dependent condition that produces High attack complexity (AC:H) and makes exploitation non-deterministic, typically needing repeated attempts. Limiting factors: no remote vector (local only), no exploitation without prior local access, and the race's unreliability (SSVC Automatable: no) constrains practical, scalable abuse. Most impactful on shared/multi-user systems (terminal servers, shared workstations) where untrusted low-privileged users coexist with the privileged cleanup process.

This is a genuine but moderate-priority local elevation-of-privilege issue, not a widespread drive-by threat. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N) confirms the attacker must already have local, low-privileged access to the host and must win a timing-sensitive race (TOCTOU, CWE-367), which is reflected in the High attack complexity. All three impact metrics are High (C:H/I:H/A:H), consistent with SSVC's 'Technical Impact: total' rating - a successful exploit yields full control. However, the mitigating signals dominate real-world urgency: SSVC reports Exploitation 'none' and Automatable 'no' (a race condition is inherently hard to reliably automate), there is no CISA KEV listing and no public POC, so exploitation status is 'no public exploit identified at time of analysis.' EPSS data was not provided in the input and cannot be factored in. The practical priority is to patch during normal cycles on multi-user, terminal-server, or shared workstation environments where untrusted low-privileged users exist; on single-admin endpoints the local, high-complexity nature makes it lower urgency. Note a metadata conflict: the input tag labels this 'Information Disclosure,' but the description and C/I/A=High impact describe local privilege elevation - the tag appears mislabeled and should be verified against the Microsoft advisory.

A low-privileged but authenticated local user on a Windows host runs a program that races the Setup Files Cleanup routine, swapping a checked file/path for a malicious target in the window between validation and use (TOCTOU). Winning the race causes the privileged cleanup operation to act on attacker-controlled content, granting SYSTEM-level privileges. No public exploit code has been identified, and the High attack complexity means the race must be won reliably, which typically requires multiple attempts.