Windows Clipboard Service CVE-2026-85863

Exploitation requires the attacker to already have authenticated local access as a low-privileged user (PR:L) with the ability to run code that interacts with the Windows Clipboard User Service; there is no network vector and no user interaction by a victim (AV:L/UI:N). The limiting factor is the high attack complexity (AC:H): as a use-after-free (CWE-416), reliable exploitation almost certainly depends on winning a race condition to reallocate freed memory with attacker-controlled data, making exploitation timing-sensitive and non-deterministic. Affected systems are supported Windows releases below the patched builds (e.g., Windows 11 24H2 below 10.0.26100.9711, Windows 10 1809/Server 2019 below 10.0.17763.9376, Server 2022 below 10.0.20348.5761); patched builds are not vulnerable. No special non-default configuration is called out - the Clipboard User Service is a standard per-user Windows service.

This is a moderate-priority, real-but-not-urgent elevation-of-privilege flaw. The CVSS 3.1 base score of 7.8 (HIGH) is driven by total technical impact (C:H/I:H/A:H) and a scope change (S:C), but the exploitability metrics temper real-world risk: AV:L requires local access, PR:L requires the attacker to already be an authenticated/authorized local user, and AC:H indicates exploitation is non-trivial - consistent with a use-after-free that likely depends on winning a race condition. CISA's SSVC decision framework corroborates a lower operational urgency: Exploitation=none (no observed or public exploitation), Automatable=no (cannot be reliably mass-exploited), while Technical Impact=total aligns with the full C/I/A compromise. There is no CISA KEV listing and no POC referenced in the provided data, so there is no public exploit identified at time of analysis - the signals are internally consistent (low exploitation probability, high but conditional impact), with no conflicts between the CVSS vector, SSVC, and exploitation status. Note that EPSS is not provided in the input, so probabilistic exploitation likelihood could not be factored. In short: a genuine local privilege-escalation primitive useful as a post-compromise step, but not a remote, wormable, or currently-exploited threat - patch on a normal Patch Tuesday cadence rather than emergency.

An attacker who has already gained low-privileged code execution on a Windows host (e.g., via phishing, a compromised standard user account, or a chained initial-access bug) interacts with the Clipboard User Service to trigger a use-after-free, winning a memory-reuse race to corrupt freed memory. Successful exploitation elevates them from a limited user to higher privileges, enabling full compromise of the system. No public exploit is identified at time of analysis, and the high attack complexity (AC:H) means reliable exploitation requires precise timing.