Windows Servicing Stack CVE-2026-96939

Exploitation requires the attacker to already hold local, authenticated access to an affected host (PR:L) and to interact with the Windows Servicing Stack Updates (SSU) component - the Windows subsystem that services and installs updates. The core limiting factor is the TOCTOU race window (CWE-367, reflected as AC:H): the attacker must reliably win the timing gap between a security validation and the subsequent resource use, which typically demands repeated attempts and precise timing and is not guaranteed on any single try. No user interaction is needed (UI:N) and the attack is not network-reachable (AV:L). Affected and unpatched builds include Windows 11 23H2 (<10.0.22631.7652), 24H2/25H2/26H2 (<...9711 / ...26300.9711), 26H1 (<10.0.28000.3231), and Windows Server 2025 including Server Core (<10.0.26100.33650); patched builds are not vulnerable.

This is a credible but not top-tier priority. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0 HIGH) describes a local elevation-of-privilege flaw in the Windows Servicing Stack: the attacker must already have local, authenticated access (PR:L) and must win a race window (AC:H), but on success gains full confidentiality, integrity, and availability impact - consistent with SYSTEM-level privilege escalation. No EPSS score, CISA KEV listing, POC, or SSVC decision data was provided, so there is no signal of active or probable exploitation: exploitation status is 'no public exploit identified at time of analysis.' The high attack complexity inherent to TOCTOU races (CWE-367) further lowers the likelihood of reliable, widespread exploitation. The signals are internally consistent - a local EoP with no remote reachability - so there is no CVSS-versus-description conflict to flag. One metadata conflict exists: the input Tag 'Information Disclosure' contradicts the description (privilege elevation) and the C:H/I:H/A:H vector, which indicates far more than disclosure. Net: a patch-promptly item for privileged/multi-user Windows hosts, not an emergency drop-everything issue absent any exploitation evidence.

A local, already-authenticated attacker (or malware running as a low-privileged user) on a Windows 11 or Windows Server 2025 host repeatedly triggers Servicing Stack Update operations and races the gap between a security check and the subsequent file/resource use. By winning that timing window, the attacker manipulates the operation to execute with elevated rights, escalating to SYSTEM. No public exploit code is known at time of analysis, and the high attack complexity means exploitation requires precise timing and likely many attempts.