Windows Phone Service CVE-2026-85357

Exploitation requires the attacker to already possess a local, low-privileged authenticated account (PR:L) on an affected build of Windows 11 (23H2 through 26H2) or Windows Server 2022 - this is not remotely reachable (AV:L). The core limiting factor is the race-condition timing: per CVSS AC:H, the attacker must repeatedly and reliably win a narrow synchronization window in the Windows Phone Service shared resource, which is non-deterministic and typically requires many attempts. No user interaction is needed (UI:N), and the flaw affects default configurations of the vulnerable component, but the combination of required local access plus difficult timing substantially narrows realistic exploitation.

This is a genuine but non-urgent patch-cycle item rather than an emergency. The CVSS 3.1 base score of 7.0 (High) is driven by total impact (C:H/I:H/A:H) tempered by significant barriers: the vector is local-only (AV:L), requires high attack complexity (AC:H - characteristic of race conditions that need precise timing to win), and already needs a foothold with low privileges (PR:L). All exploitation signals point AWAY from imminent mass exploitation: CISA SSVC lists Exploitation as 'none' and Automatable as 'no', there is no CISA KEV listing, and no public exploit was identified in the provided data. The only amplifying factor is SSVC Technical Impact 'total', which is consistent with a privilege-escalation outcome. In short, high technical impact is offset by low real-world exploitation likelihood and difficult exploitation conditions - this should be prioritized within normal Patch Tuesday remediation, not treated as a drop-everything zero-day. One data inconsistency to note: the input Tags include 'Information Disclosure', yet both the description and the CVSS impact profile describe a local elevation-of-privilege race condition, so that tag appears mislabeled.

An attacker who already has a low-privileged local account on an affected Windows 11 or Windows Server 2022 host runs a program that repeatedly triggers the Windows Phone Service while racing a shared resource. By winning the timing window (which takes many attempts given the high attack complexity), the attacker corrupts synchronization state and gains SYSTEM-level privileges. No public exploit code was identified at time of analysis, and no user interaction is required.