Windows Clipboard Service CVE-2026-85912

Requires the attacker to already hold a local, low-privileged authenticated session on the target Windows host (PR:L, AV:L) - there is no remote or unauthenticated path. Exploitation specifically targets the Windows Clipboard User Service and depends on winning a race condition (CWE-362) on an improperly synchronized shared resource, which per the CVSS AC:H and SSVC Automatable=no is non-deterministic and typically needs many repeated attempts; it is not reliably one-shot and resists automation. No user interaction is required (UI:N). Limiting factors: prior code-execution/logon foothold, timing-dependent reliability, and local-only access substantially reduce realistic risk below what the 7.0 score alone suggests.

This is a genuine but moderate-priority local privilege escalation. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.0 HIGH) describes an attack that is local only, requires existing low-level authenticated access, and has HIGH attack complexity - consistent with winning a race condition (CWE-362) in the Clipboard User Service, which is inherently timing-dependent and non-deterministic. All three exploitation signals point AWAY from urgency: there is no CISA KEV listing, no public POC identified, and CISA SSVC explicitly scores Exploitation=none and Automatable=no. The one signal that raises the stakes is SSVC Technical Impact=total, matching the C:H/I:H/A:H full-impact rating: successful exploitation yields complete control of the targeted service context (effectively SYSTEM-level escalation). Net: a high-CVSS flaw whose real-world risk is tempered by the local vector, required prior foothold, high complexity, and absence of any exploitation evidence. It is a reliable second-stage escalation primitive for an attacker already on the host, not an internet-facing emergency. Note one metadata conflict: the input Tags include 'Information Disclosure', but the description and the I:H/A:H impact describe privilege elevation, not disclosure - treat the tag as suspect.

An attacker who already has a low-privileged authenticated session on a Windows host (e.g., via phishing, a compromised standard user account, or a prior RCE) runs a local tool that repeatedly races the Clipboard User Service to win a narrow synchronization window on a shared resource. Because attack complexity is high, the attacker must loop the trigger many times until the race is won, after which they gain elevated privileges on the machine. No public exploit code has been identified at time of analysis, so this would require custom tooling.