Wired AutoConfig Service CVE-2026-85829

Requires the attacker to already hold an authenticated, low-privileged local account or session on the target Windows host (AV:L, PR:L) - this is a post-access escalation, not a remote entry point. The vulnerable component is the Wired AutoConfig service (dot3svc), which manages IEEE 802.1X authentication for wired Ethernet and is present on all supported Windows 10/11 and Windows Server builds listed in the EUVD data. No user interaction is needed (UI:N) and complexity is low (AC:L). The primary limiting factors are the need for prior local authenticated access and the requirement to reach/interact with the dot3svc service; remote or unauthenticated exploitation is not possible per the vendor CVSS vector.

This is a credible but not emergency-tier local privilege escalation. The CVSS 3.1 vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) describes a locally-exploitable, low-complexity flaw requiring low privileges (PR:L) and no user interaction, yielding full confidentiality, integrity and availability impact - consistent with a CWE-415 double free in a Windows service that can be driven to code execution at SYSTEM. The signals are mutually consistent and point to moderate real-world urgency rather than crisis: CISA's SSVC decision framework records Exploitation=none and Automatable=no, meaning no observed exploitation and no reliable mass-automation path, though Technical Impact=total agrees with the C:H/I:H/A:H rating. There is no KEV listing and no POC referenced, so per the available data this is 'no public exploit identified at time of analysis.' EPSS is NOT provided in the input, so exploitation probability cannot be quantified here. Because the attack vector is local and requires an already-authenticated foothold, this is a post-compromise escalation primitive - valuable to an attacker who already has a user-level session, but not a remote entry point. Prioritize via normal Microsoft patch cycles, elevated for multi-user or shared Windows hosts where untrusted users hold local accounts.

An attacker who already has a low-privileged authenticated session on a Windows host (via phishing foothold, stolen credentials, or a standard user account on a shared machine) locally interacts with the Wired AutoConfig (dot3svc) service to trigger the double free, corrupting memory to gain code execution as SYSTEM. No user interaction is required (UI:N) and attack complexity is low (AC:L), but the attacker must first possess local access and valid privileges (AV:L/PR:L). No public exploit is identified at time of analysis.