Windows License Service CVE-2026-96912

Exploitation requires the attacker to already possess authenticated low-privileged local access to the Windows host (CVSS PR:L, AV:L) and the ability to execute a crafted local process that interacts with the Windows Client License Service to trigger the use-after-free; it cannot be launched remotely or by an unauthenticated user. No user interaction is required (UI:N). Limiting factors: the local-access prerequisite confines this to post-foothold privilege escalation, and the affected system must be running an unpatched build within the listed ranges (e.g., Windows 11 24H2 below 10.0.26100.9711, Server 2022 below 10.0.20348.5761); patched builds are not exploitable.

This is a credible but not emergency-priority local privilege escalation. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) describes a locally-exploitable use-after-free requiring low privileges and no user interaction, with total impact to confidentiality, integrity, and availability on the affected system - consistent with CISA's SSVC rating of 'Technical Impact: total.' However, the signals converge on moderate rather than critical real-world urgency: SSVC lists Exploitation as 'none' and Automatable as 'no,' there is no CISA KEV listing, and no public proof-of-concept is referenced. The requirement for an attacker to already have authenticated local access (PR:L) substantially limits scope to post-compromise scenarios (e.g., an attacker who has gained a foothold seeking SYSTEM). No EPSS score was provided in the input, so probability-of-exploitation cannot be quantified here. There are no conflicting signals: the network-independent local vector in CVSS aligns with the description's 'elevate privileges locally.' Overall this is a standard-priority patch-cycle item for environments where untrusted local code execution is a concern, not a drop-everything issue.

An attacker who has already obtained low-privileged authenticated access to a Windows host (e.g., via a phishing payload, a compromised standard user account, or a prior low-severity bug) runs a crafted local program that manipulates object lifetime in the Windows Client License Service to trigger a use-after-free. By controlling the freed-then-reused memory, the attacker executes code in the service's elevated context to escalate to SYSTEM. No public exploit code or active exploitation has been identified at time of analysis.