Windows Embedded Mode CVE-2026-85914

Exploitation requires the attacker to already possess local, authenticated access to the host (PR:L) with the ability to interact with the Windows Embedded Mode Service, and the vulnerable service must be present/active on the target build (affected ranges per EUVD include Windows 11 23H2-26H2, Windows 10 1607-22H2, and Windows Server 2016-2025). The primary limiting factor is the AC:H race condition inherent to the use-after-free: the attacker must win a narrow timing window between the free and reuse of the object, so exploitation is non-deterministic and typically needs multiple attempts rather than a single reliable trigger. No user interaction is required (UI:N), but remote exploitation is not possible (AV:L). Applying the vendor patch (e.g., 10.0.26100.9711 for 24H2, 10.0.22631.7652 for 23H2) removes the condition.

This is a moderate-priority local privilege escalation rated CVSS 7.0, and the available signals converge on 'real but not urgent.' The CVSS vector (AV:L/AC:H/PR:L/UI:N) confirms the attacker must already have local, authenticated access to the host and must win a timing-sensitive race condition - the AC:H rating reflects the non-deterministic nature typical of use-after-free (CWE-416) exploitation. CISA's SSVC framework reinforces lower urgency: Exploitation=none (no observed activity), Automatable=no (cannot be reliably mass-scripted, consistent with AC:H), though Technical Impact=total aligns with the C:H/I:H/A:H full-compromise outcome if successful. There is no CISA KEV listing and no public exploit identified at time of analysis, so this is not currently a widespread or opportunistic threat. The high severity derives from impact (full SYSTEM-level compromise) rather than from ease or likelihood of exploitation. No EPSS score was provided in the input, so probabilistic exploitation likelihood could not be weighed. Note a minor conflict: the input Tags include 'Denial Of Service' while both the description and CVSS (C:H/I:H/A:H) frame this as a full privilege-escalation/code-execution issue - treat DoS as at most a secondary effect, not the primary risk.

An attacker who has already gained a low-privileged foothold on a Windows host (e.g., via phishing, a standard user account, or a compromised service) targets the Embedded Mode Service and repeatedly triggers a use-after-free condition, racing to reclaim the freed memory with attacker-controlled data. On a successful race, they corrupt kernel or service memory to execute code at elevated (SYSTEM) privilege, fully compromising the machine. No public exploit was identified at time of analysis, and the high attack complexity (race condition) means exploitation is not guaranteed on each attempt.