Windows CimFS CVE-2026-85823

Exploitation requires the attacker to already have local access to the host with low-level (standard user / PR:L) privileges and the ability to execute code that interacts with the Windows Composite Image File System (CimFS) driver - the component is present by default on affected Windows 11 (24H2/25H2/26H1/26H2) and Windows Server 2022/2025 builds, so no non-default feature toggle is documented as required. Key LIMITING factors: there is no remote vector (AV:L - attacker must be on the box), no path to exploitation from an unauthenticated position (PR:L), and High attack complexity (AC:H) because triggering and reliably exploiting a use-after-free depends on winning a memory-reclamation race, making exploitation non-deterministic. No user interaction is required (UI:N).

This is a medium-to-high priority local privilege escalation, not a drop-everything emergency. The CVSS 3.1 base score of 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects full confidentiality, integrity, and availability impact once exploited, but the real-world risk is tempered by two factors: the attacker must already have local access and low-level privileges (PR:L), and the attack complexity is High (AC:H) - consistent with a use-after-free that typically requires winning a race or grooming the kernel heap into a specific state, which is non-deterministic and often unreliable. No EPSS score was supplied, so widespread-exploitation probability cannot be quantified. The vulnerability is NOT listed in CISA KEV and no public exploit or POC is referenced, so there is no evidence of active exploitation; it was reported privately by Microsoft (secure@microsoft.com) and patched, which is the typical coordinated-disclosure pattern rather than an in-the-wild discovery. The 'Denial Of Service' tag conflicts with the description and CVSS: the CVE explicitly describes privilege elevation with C:H/I:H/A:H, so this reads primarily as an EoP (DoS would be a secondary effect of a memory-corruption crash, not the main consequence) - treat the DoS label with caution. Net: a legitimate patch-soon issue for a ubiquitous platform, most relevant as a post-compromise local privilege-escalation primitive (e.g., sandbox escape or malware escalating from a standard user), but the AC:H and PR:L requirements make mass exploitation unlikely absent a reliable public exploit.

An attacker who already has low-privileged code execution on a Windows host (via phishing, a compromised standard-user account, or a sandboxed process) runs a crafted program that manipulates the Composite Image File System (CimFS) driver to trigger a use-after-free in kernel memory. By grooming the heap and winning the timing race (AC:H), they reclaim the freed object to corrupt kernel state and elevate to SYSTEM. No public POC or exploit code is referenced at the time of analysis.