Windows SmartScreen CVE-2026-85851

Exploitation requires local access to an affected Windows host AND an existing authenticated session with at least low (standard-user) privileges (AV:L, PR:L); it cannot be triggered remotely or by an unauthenticated actor. No user interaction is needed (UI:N). The vulnerable component is Windows SmartScreen, which is a default-present Windows reputation/security feature, so no special non-default configuration is indicated by the available data. Affected builds are specific: Windows 11 (23H2 <10.0.22631.7652, 24H2 <10.0.26100.9711, 25H2 <10.0.26200.9711, 26H1 <10.0.28000.3231, 26H2 <10.0.26300.9711) and Windows Server 2025 (<10.0.26100.33650); patched builds at or above these versions are not exploitable. The principal limiting factor is the local-access-plus-privilege prerequisite, which confines this to post-compromise privilege escalation rather than initial access.

This is a locally-exploitable privilege-escalation flaw (CWE-416 use-after-free) in Windows SmartScreen, rated CVSS 7.8 (HIGH). The vendor-supplied CVSS vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) is internally consistent and typical of a Microsoft Patch-Tuesday local EoP: an attacker needs local access and at least low privileges (PR:L), no user interaction is required, complexity is low, and successful exploitation yields full confidentiality, integrity and availability impact on the host. There is NO CISA KEV listing and NO public exploit code referenced in the supplied data, so exploitation status is 'no public exploit identified at time of analysis.' EPSS is NOT provided in the input, so exploitation probability cannot be quantified. Net assessment: this is a real but second-tier priority - the AV:L/PR:L requirement means it is not remotely or unauthenticated-reachable and would typically be chained after an initial foothold (e.g., as a second-stage local EoP), rather than a mass-exploitable internet-facing bug. It warrants routine-to-prompt patching given the ubiquity of Windows and the memory-corruption class, but absent KEV/EPSS/POC signals there is no evidence of active or imminent widespread exploitation. Note a minor signal conflict: the input Tags include 'Denial Of Service' while the description and CVSS scope the impact as local privilege elevation - the A:H metric plausibly covers a DoS side effect, but the primary impact per Microsoft is EoP.

An attacker who already has a low-privileged foothold on a Windows 11 or Server 2025 host (e.g., via phishing or a compromised standard user account) triggers the use-after-free in SmartScreen to corrupt memory and execute code at elevated privilege. No user interaction is required. No public proof-of-concept is referenced in the available data, so weaponization effort is presently unknown.