Windows Clipboard Service CVE-2026-85861

Exploitation requires the attacker to already possess local, authenticated low-privileged access (PR:L, AV:L) to the target host and the ability to execute code that interacts with the Windows Clipboard User Service; no user interaction by a victim is needed (UI:N). The use-after-free is gated by HIGH attack complexity (AC:H) - the attacker must win a race/timing window and reliably reclaim the freed object, so exploitation is not guaranteed on a single attempt and resists automation (SSVC Automatable=no). The Clipboard User Service is present in default Windows configurations, so no special feature toggle is required, but the prerequisite local foothold and the timing dependency are the primary limiting factors against real-world abuse.

This is a locally-exploitable elevation-of-privilege flaw with a CVSS 3.1 base score of 7.8 (AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H), meaning an attacker who already has a foothold as a low-privileged authenticated user can abuse a use-after-free in the Windows Clipboard User Service to gain higher privileges. The signals are consistent but temper each other: the CVSS vector requires LOCAL access (AV:L), already-held low privileges (PR:L), and notably HIGH attack complexity (AC:H) - characteristic of a use-after-free that depends on winning a memory-timing race, which lowers real-world reliability. CISA's SSVC decision framework reinforces a measured posture: Exploitation=none (no observed exploitation), Automatable=no (cannot be reliably mass-exploited), but Technical Impact=total (full compromise of the affected component if successful). There is no CISA KEV listing and no public exploit identified, and no EPSS score was supplied in the input, so exploitation probability cannot be quantified from this data. Net assessment: a credible and patch-worthy local privilege-escalation primitive - valuable as a post-compromise step in an attack chain - but NOT an internet-facing, wormable, or currently-exploited emergency. Prioritize via normal Patch Tuesday cadence rather than out-of-band response.

An attacker who has already achieved low-privileged code execution on a Windows host (e.g., via phishing, a malicious document, or a compromised standard user account) runs a crafted local program that manipulates the Clipboard User Service to trigger a use-after-free, corrupting memory to execute code at a higher privilege level. Because the flaw has high attack complexity (AC:H), success typically requires winning a timing/race condition and may need multiple attempts. No public exploit code was identified at the time of analysis.