Windows SysMain CVE-2026-96306

Exploitation requires the attacker to already have local, authenticated access to the Windows host as a low-privileged user (PR:L) and the ability to execute code that interacts with the Sysmain (SysMain/Superfetch) service, which is enabled by default on standard Windows client and server installations. No user interaction is needed (UI:N) and attack complexity is low (AC:L). Limiting factors: the flaw is NOT remotely exploitable (AV:L) - the attacker must first obtain a foothold on the machine - so it cannot be used for initial access and is confined to privilege escalation after compromise; environments where the Sysmain service is disabled would reduce the attack surface.

CVSS 3.1 base score is 7.8 (High) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating a local, low-complexity privilege-escalation flaw that requires an already-authenticated low-privileged user (PR:L) but no user interaction. This is a classic local EoP profile: not remotely reachable, so it is a second-stage weapon used after an attacker already has code execution on the host, rather than an initial-access vector. No EPSS score was provided in the input, and the vulnerability is NOT listed in CISA KEV and has no public exploit identified at time of analysis, so there is no current evidence of active or widespread exploitation. Net real-world priority is moderate-to-high for patch prioritization because the affected product (Windows) is ubiquitous and local EoP bugs are routinely chained into post-compromise toolkits, but it is not an emergency drop-everything issue absent exploitation signals. One data conflict to verify: the Description states an 'Out-of-bounds read' (CWE-125), which is primarily an information-disclosure/memory-read primitive, yet the supplied CVSS rates Integrity and Availability as High (I:H/A:H); an OOB read alone usually yields C:H with lower I/A, so the full-CIA rating appears to reflect the ultimate privilege gain rather than the read primitive itself - treat I:H/A:H as vendor-assigned and verify against the Microsoft advisory.

A low-privileged user who already has a foothold on a Windows host (e.g., via phishing or an existing malware implant) runs a crafted program that triggers an out-of-bounds read in the Sysmain service to leak sensitive memory and elevate to higher privileges. Because the vector is local and requires no user interaction, this is used as a post-exploitation privilege-escalation step to reach SYSTEM. No public proof-of-concept or exploit code was identified in the provided data.