Windows DFS CVE-2026-96938

Requires an attacker to already have authenticated local access to an affected Windows system and to reach the Distributed File System (DFS) code path that mishandles the heap allocation; exploitation is local only (AV:L) with no user interaction and no network vector. Limiting factors: the attacker must hold valid credentials on the host and, per Microsoft's PR:H rating, meaningful existing privileges, which confines realistic risk to multi-user, terminal-server, or shared-workstation scenarios where an untrusted authenticated principal is present; it cannot be triggered remotely or by an unauthenticated user. Affected builds span Windows 10/11 (1607 through 26H2), Windows Server 2012 through 2025 including Server Core - patch before the listed fixed builds (e.g., 10.0.26100.33650 for Server 2025).

This is a moderate-priority, local privilege-escalation issue rather than a top-tier emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base 6.7) confirms the attacker must already be local and, per Microsoft's own scoring, already hold high privileges - so this is a privilege-elevation step inside an existing foothold, not a remote entry point. The SSVC framework reinforces a measured response: Exploitation=none (no observed activity) and Automatable=no (cannot be mass-scripted at scale), even though Technical Impact=total, matching the full C/I/A compromise once triggered. No EPSS score was provided in the input, there is no CISA KEV listing, and no public POC is referenced, so all three widespread-exploitation signals are absent and aligned - nothing conflicts here. The one point worth flagging is the PR:H choice: 'authorized attacker' in the description only establishes authentication, not necessarily high privilege, so defenders should treat the privilege bar as 'authenticated local user' and verify the exact required privilege with Microsoft rather than assuming admin-only reachability. Overall: patch on a normal cadence, prioritizing multi-user and terminal-server hosts where untrusted authenticated users share a machine.

An authenticated local user on a Windows host runs a crafted program that drives the DFS client/component into processing malformed data, triggering the heap-based buffer overflow (CWE-122) to corrupt memory and gain SYSTEM-level code execution. Because the CVSS vector is AV:L with no user interaction (UI:N), the attack is a local, self-contained chain against an already-logged-in session, most dangerous on shared or multi-user systems. No public exploit code is identified at time of analysis, so this remains a plausible but not yet demonstrated path.