Windows WebDAV CVE-2026-85827

Exploitation requires a pre-existing authenticated local foothold (PR:L, AV:L): the attacker must already be able to execute code or interact with the WebDAV service as a low-privileged user on the target Windows host - this is a post-compromise privilege-escalation primitive, not a remote entry point. The host must be running an affected, unpatched Windows build (e.g., Windows 11 24H2 <10.0.26100.9711, Windows Server 2022 <10.0.20348.5761, Windows 10 1809 <10.0.17763.9376) with the WebDAV functionality reachable. LIMITING FACTORS: high attack complexity (AC:H) means exploitation depends on winning a race or reliably grooming the heap, reducing reliability; no remote or unauthenticated path exists; and applying the vendor patch to the listed build thresholds fully remediates.

This is a legitimate but second-tier priority. The CVSS 3.1 base score of 7.0 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects a local privilege-escalation flaw: the attacker must already be authenticated with low privileges (PR:L) and have local access (AV:L), and exploitation is gated by high attack complexity (AC:H), typically indicating a race/heap-grooming condition that is not reliably repeatable. Offsetting those mitigating factors, the impact is total (C:H/I:H/A:H) - successful exploitation yields full system compromise, consistent with a CWE-122 heap overflow in a Windows component. No EPSS score, SSVC decision, or POC indicator was provided in the input, and the CVE is NOT present in CISA KEV, so there is no evidence of active exploitation or automatable mass-exploitation. The signals are internally consistent (local vector, authenticated, high complexity) with no contradictions between the vector and the 'elevate privileges locally' description. Net: patch on normal Patch Tuesday cadence - it is a valuable post-compromise escalation primitive for an attacker who already has a foothold, but it is not a remote, pre-auth, or wormable threat and does not warrant emergency out-of-band response absent new exploitation signals.

An attacker who already holds a low-privileged foothold on a Windows host (e.g., via phishing, a stolen standard-user credential, or a prior low-impact bug) interacts with the local WebDAV service to trigger a heap-based buffer overflow. By carefully grooming the heap and winning the timing/complexity condition (AC:H), the attacker corrupts memory to execute code in the context of a higher-privileged process, escalating from standard user toward SYSTEM. No public exploit was identified in the provided data, so this scenario is inferred from the CVSS vector and CWE-122 classification.