Windows Packet Scheduler CVE-2026-87712

Requires the attacker to already have LOCAL, authenticated code-execution on the target host as at least a low-privileged user (CVSS PR:L, AV:L) - this is a post-foothold privilege-escalation primitive, not a remote entry point. The vulnerable code is in the Windows QoS Packet Scheduler (psched/pacer), a default-present networking component, so no non-default feature toggle is indicated by the available data. Exploitation is LIMITED by the need for prior local access and by patch deployment; it cannot be triggered remotely or by an unauthenticated attacker, and no user interaction (UI:N) is involved. Affected systems span Windows 10 (1607/1809/21H2/22H2), Windows 11 (23H2/24H2/25H2/26H1/26H2), and Windows Server 2012 through 2025 below the fixed builds listed in EUVD.

This is a CVSS 7.8 (High) local use-after-free (CWE-416) in the Windows QoS Packet Scheduler enabling elevation of privilege. The CVSS vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H is internally consistent with the description: local attack vector, low complexity, and low (but non-zero) privileges required - i.e. an attacker who can already execute code as a standard authenticated user on the host. No EPSS score was provided in the input, and the CVE is NOT listed in CISA KEV, with no public POC indicated, so there is no public exploit identified at time of analysis. Real-world priority should be treated as MODERATE-but-patch-promptly: the local-only vector (AV:L) means this is not a remotely wormable issue and requires a foothold first, which lowers immediate internet-facing risk, but the near-universal Windows footprint, low attack complexity, and the historical tendency of Microsoft kernel/network-driver UAF EoP bugs to be weaponized post-patch (often chained after initial access) justify prioritized patching. Note the signal conflict in metadata: the input Tags include 'Denial Of Service' while the description and CVSS (C:H/I:H/A:H) describe a privilege-escalation outcome - the primary impact is EoP, not DoS; verify intended impact with the Microsoft advisory. No EPSS and no KEV means exploitation likelihood is inferred, not confirmed.

A local, authenticated standard user (or malware running in a low-privilege context after initial access via phishing or a browser exploit) runs a crafted program that manipulates the QoS Packet Scheduler (pacer/psched) to trigger the use-after-free, corrupting kernel memory to execute code with SYSTEM privileges. Because the CVSS complexity is Low (AC:L) and no user interaction is required (UI:N), exploitation is reliable once local access is obtained. No public exploit code is identified at time of analysis, so this would currently require attacker-developed tooling.