Windows DCOM Server CVE-2026-88096

Exploitation requires the attacker to already possess authorized, low-privileged local access to the Windows host (PR:L, AV:L) and to interact directly with the DCOM Server component, which is present by default on all supported Windows editions, so no non-default configuration is needed. The principal limiting factor is the race condition itself: AC:H reflects that success depends on winning a narrow, timing-dependent window in the improperly synchronized shared resource, which may demand repeated attempts and is not guaranteed on any single try. No user interaction is required (UI:N), and the impact is confined to the local system (scope unchanged), meaning this is a local privilege-escalation primitive rather than a remotely reachable flaw.

This is a locally-exploitable elevation-of-privilege flaw with a moderate CVSS base score of 7.0. The provided CVSS vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) is internally consistent with the description: an authorized (PR:L) attacker who already has local (AV:L) code-execution on the host can win a race condition (AC:H, reflecting the timing-dependent reliability of CWE-362 exploitation) to gain full confidentiality, integrity and availability impact on the same system (scope unchanged). No EPSS score, KEV listing, POC, or SSVC decision data was supplied, so exploitation-probability and automatability signals are entirely absent. In the absence of those signals, real-world priority rests on the CVSS profile alone: the high attack complexity and requirement for pre-existing local privileges make this a post-compromise privilege-escalation primitive rather than an initial-access or wormable threat, so it is a meaningful but not emergency-tier issue - typically patched on a normal Patch Tuesday cadence. The signals do not conflict, but note that no public exploit is identified at time of analysis and there is no evidence of active exploitation, so urgency should not be inflated beyond the local, high-complexity nature of the bug.

An attacker who has already obtained low-privileged code execution on a Windows host (e.g. via a compromised standard user account or a foothold from another vulnerability) repeatedly triggers DCOM Server operations to win a timing-sensitive race condition in its shared-resource handling. Successful exploitation escalates the attacker from limited local privileges to full control of the system. No public exploit code has been identified at time of analysis, and the high attack complexity means exploitation may require many attempts to reliably hit the race window.