Windows Servicing Stack CVE-2026-85318

Exploitation requires the attacker to already possess authenticated low-privileged (PR:L) local (AV:L) access to a Windows system running a vulnerable Servicing Stack Updates build, and to execute a crafted program locally that triggers the heap overflow - no user interaction by a victim is needed (UI:N). The decisive limiting factors are: (1) the attacker must first achieve initial local code execution by other means, so this cannot be a standalone remote entry point; (2) SSVC rates the attack non-automatable, indicating bespoke, per-target exploitation rather than mass scripting; and (3) the target must be below the fixed build (e.g., Windows 11 24H2 <10.0.26100.9711, Windows Server 2025 <10.0.26100.33650, Server 2019/10 1809 <10.0.17763.9376). It affects default Windows installations since Servicing Stack Updates is a core OS component, so no special non-default configuration is required.

Multiple signals converge on this being a moderate-priority local privilege escalation rather than an urgent remote threat. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N) confirms local access with low existing privileges is required, yielding a 7.8 HIGH score driven by full C:H/I:H/A:H impact - consistent with SSVC's 'Technical Impact: total'. However, the risk-tempering signals dominate: SSVC reports 'Exploitation: none' and 'Automatable: no', the vulnerability is NOT in CISA KEV, and no public exploit code was identified. No EPSS score was provided in the input, so exploitation probability cannot be independently quantified. These signals are mutually consistent - a locally-exploitable EoP in Servicing Stack Updates that an attacker can only reach after already having a foothold, and which cannot be weaponized at scale. This is a genuine 'patch-in-normal-cycle' issue, not a high-CVSS/low-real-risk artifact nor a drop-everything emergency: the high score reflects real total system impact once triggered, but the local-only, authenticated, non-automatable nature keeps real-world urgency moderate. It is best treated as a privilege-escalation building block an attacker chains after initial access.

An attacker who has already gained low-privileged code execution on a Windows host (e.g., via phishing or a separate initial-access flaw) runs a crafted program that triggers the heap-based buffer overflow in the Servicing Stack Updates component, corrupting heap memory to execute code at SYSTEM level. No public exploit code was identified at time of analysis, and the SSVC framework rates the attack as non-automatable, so exploitation would require bespoke local tooling.