Windows Setup Cleanup CVE-2026-83509

Requires an attacker who already has authenticated, low-privileged local access to the Windows host (PR:L, AV:L) and the ability to write a malicious binary into a directory that the Windows Setup Files Cleanup component searches ahead of the trusted location. Exploitation is LIMITED by high attack complexity (AC:H): the attacker must satisfy conditions outside their control, such as a writable/attacker-controllable search-path directory or a timing/race window when the cleanup routine runs, so this is not reliably exploitable against hardened, fully-patched, or default-permission configurations. No user interaction by a victim is required (UI:N), but remote-only or unauthenticated attackers cannot trigger it.

This is a locally-exploitable elevation-of-privilege flaw (CWE-426, untrusted search path) in the Windows Setup Files Cleanup component, carrying a vendor CVSS of 7.0 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). The signals are internally consistent and point to a real-but-not-urgent issue: the attack vector is local (AV:L) and requires an already-authenticated low-privilege foothold (PR:L), with high attack complexity (AC:H) implying conditions outside the attacker's direct control - typically winning a race or getting a malicious binary into a writable search-path directory. CISA's SSVC framework reinforces a lower operational priority: Exploitation=none (no observed or public exploitation) and Automatable=no, even though Technical Impact=total (consistent with the C:H/I:H/A:H full-SYSTEM compromise on success). No EPSS score was supplied, no CISA KEV listing is present, and no public POC is indicated, so there is no evidence of active exploitation - the exploitation status is 'no public exploit identified at time of analysis.' Net: this is a legitimate privilege-escalation bug worth patching in routine Patch Tuesday cycles rather than an emergency, because exploitation requires prior local access plus favorable non-default conditions (AC:H). The main caveat is the input Tag 'Information Disclosure,' which contradicts the description and CVSS - this is an elevation-of-privilege vulnerability, not an information-disclosure one.

A low-privileged but authenticated local user plants a malicious DLL or executable in a directory that the Windows Setup Files Cleanup component searches before the legitimate path, then triggers or waits for the cleanup routine to run so the planted code executes in the elevated (SYSTEM) context. The AC:H rating means the attacker must satisfy additional conditions - such as a writable search-path location or a timing window - so success is not guaranteed on every attempt. No public exploit code has been identified at the time of analysis.