Windows WebDAV CVE-2026-85370

Exploitation requires the attacker to already have authenticated, interactive local access to the Windows host as a low-privileged user (PR:L, AV:L) and to invoke the vulnerable WebDAV (WebClient/redirector) code path that frees and then reuses the object. The key limiting factor is the high attack complexity (AC:H): the use-after-free is a timing/race-dependent condition the attacker must reliably win, and no user interaction by a victim is involved (UI:N). Realistic risk is concentrated on multi-user or shared systems (terminal servers, RDP hosts, shared workstations) where untrusted users can run code locally; single-user, fully-trusted endpoints face lower practical exposure. All listed Windows versions below the fixed build numbers are affected in default configurations once the WebDAV client functionality is reachable.

This is a genuine but not top-tier priority. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0) describes a local privilege-escalation flaw: the attacker must already have a foothold on the host (PR:L, authorized low-privilege user) and overcome a race-condition-style high attack complexity (AC:H), but a successful exploit yields total compromise of confidentiality, integrity and availability on that system. CISA's SSVC framework corroborates the limited urgency: Exploitation=none (no observed exploitation), Automatable=no (consistent with AC:H and the local, interaction-dependent nature of a use-after-free), yet Technical Impact=total (consistent with C:H/I:H/A:H full takeover). No EPSS score is provided, there is no CISA KEV listing, and no public exploit code is referenced, so there is no public exploit identified at time of analysis. The signals are internally consistent rather than conflicting - a high-impact-but-hard-to-exploit local EoP in a hugely deployed product. Prioritize via normal patch-management rather than emergency response, but patch promptly on multi-user, terminal-server, and shared-host systems where local low-privilege access is realistic.

A low-privileged user already logged into a Windows host (e.g. on a shared workstation or Remote Desktop/terminal server) runs a crafted program that manipulates WebDAV client/redirector object handling to trigger a use-after-free. By winning the required timing race (AC:H) and grooming the freed memory, the attacker reuses the dangling object to execute code in a higher-privileged context, elevating to SYSTEM. No public exploit code is identified at time of analysis, and the high attack complexity makes reliable exploitation non-trivial.