Windows StateRepository CVE-2026-85911

Requires the attacker to already possess local, authenticated low-privileged code execution on the target Windows host (PR:L, AV:L) in order to invoke the vulnerable StateRepository API - it cannot be triggered remotely or by an unauthenticated actor. No special non-default configuration or feature toggle is indicated in the description; the API is a standard Windows component present across all affected client and server builds. The limiting factor is the prerequisite local foothold: exploitation is gated by prior access rather than by any product setting, so it functions as a post-compromise escalation step, not an entry point.

This is a credible but not emergency priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U, C:H/I:H/A:H, base 7.8 HIGH) describes a local privilege-escalation flaw: the attacker must already have low-privileged code execution on the host (PR:L) and act locally (AV:L), with low complexity and no user interaction. This is the classic profile of a post-compromise escalation primitive rather than an initial-access vulnerability. No EPSS score was supplied, so exploitation probability cannot be quantified from the input. The CVE is NOT in CISA KEV and no public exploit code is referenced, so there is no public exploit identified at time of analysis - this should be treated as distinct from active exploitation. Use-after-free in a core Windows component (CWE-416) is historically a favored target for exploit developers and is frequently chained after phishing/initial access, which raises latent risk even without current public POC. No SSVC decision data was provided in the input. Overall: a real, patch-worthy issue widely applicable across the Windows fleet, but dependent on prior local access and currently lacking evidence of in-the-wild use.

An attacker who has already gained low-privileged execution on a Windows host (e.g., via phishing or a compromised standard user account) invokes the StateRepository API in a crafted sequence to trigger a use-after-free, corrupting kernel/service-managed memory to run code at a higher privilege level. Because AC:L and UI:N, the trigger is reliable and needs no victim interaction once local access exists. No public exploit code is identified at time of analysis, so weaponization would require independent development.