Camera Frame Server CVE-2026-85803

Exploitation requires an existing authenticated local session on the host (PR:L) - this is not remotely reachable (AV:L) and needs no user interaction (UI:N). The specific prerequisite is the ability to interact with the Windows Camera Frame Server Monitor service to drive it into a use-after-free state, which per the high attack complexity (AC:H) realistically requires winning a timing/race window, making reliable exploitation difficult. Limiting factors that reduce real-world risk: the attacker must already have a local foothold and standard-user privileges, exploitation reliability is constrained by the race condition, and only the enumerated unpatched Windows 11 (23H2/24H2/25H2/26H1/26H2) and Windows Server 2025 builds are affected; patched builds (e.g., 10.0.26100.9711 and later for 24H2) are not.

This is a moderate-priority local privilege escalation flaw, not an internet-facing emergency. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N) confirms the attacker must already have local, authenticated access (PR:L) and must win a race condition or meet other difficult preconditions (AC:H), which materially lowers reliability of exploitation. Impact is severe once triggered (C:H/I:H/A:H, scope unchanged), consistent with a kernel/service-level use-after-free yielding SYSTEM-level control. No KEV listing is present in the input, so there is no public evidence of active exploitation; no POC is referenced, so no public exploit code is identified; and no EPSS score was provided, so statistical exploitation probability cannot be weighed. The signals are therefore internally consistent - a genuinely dangerous outcome gated behind high attack complexity and prior local foothold - but with a notable data gap: the base CVSS was supplied by Microsoft (self-reported), and EPSS/KEV/POC are all absent rather than confirmed-negative, so 'no public exploit' means 'none identified at analysis time,' not 'none exists.' Prioritize as part of routine Patch Tuesday remediation on multi-user and shared Windows hosts rather than as an out-of-band crisis.

A low-privileged but authenticated user (or malware already running in a standard user session) on a Windows 11 or Server 2025 host triggers a use-after-free in the Camera Frame Server Monitor by manipulating camera frame-server objects to reach a freed pointer, likely by winning a timing race (AC:H). Successful exploitation corrupts memory in the privileged service and escalates to SYSTEM, enabling full host compromise. No public exploit code is identified at time of analysis, and the high attack complexity suggests exploitation is non-trivial and not yet commoditized.