Windows CSC Driver CVE-2026-96948

Exploitation requires the attacker to already have local, authenticated access to the Windows host with at least low-level privileges (CVSS PR:L, AV:L) - it cannot be triggered remotely or by an unauthenticated user. No user interaction is needed (UI:N). The affected component is the Client Side Caching driver (csc.sys), which backs the Offline Files feature; the flaw is present in default installations of all supported Windows client and server editions, so no special configuration is required to be vulnerable, though the practical value of the leak depends on what cached/offline-file data exists on the target. Limiting factors: the mandatory local presence and pre-existing privileges substantially raise the bar, making this a post-compromise information-disclosure primitive rather than an entry point; impact is confined to confidentiality (I:N/A:N).

This is a genuine but low-priority vulnerability. All signals align toward limited real-world urgency: the CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) scores 5.5 (Medium) and explicitly requires LOCAL access (AV:L) plus existing low-level privileges (PR:L), meaning an attacker must already be authenticated on the host before exploiting csc.sys. CISA's SSVC framework corroborates this: Exploitation=none (no observed or public exploitation), Automatable=no (cannot be mass-scripted at scale), and Technical Impact=partial (not total system compromise). The vulnerability is NOT listed in CISA KEV, and no EPSS score was provided in the input - so there is no quantitative exploitation-probability signal to weigh. No public exploit code was identified at time of analysis. The only elevated metric is C:H (high confidentiality impact), which reflects CWE-497's potential to leak sensitive system information, but with I:N/A:N there is no integrity or availability impact. In short: a high-confidentiality but local, authenticated, non-automatable info-disclosure bug. It is a routine patch-cycle item rather than an emergency, best treated as a privilege-boundary/defense-in-depth fix. No conflicting signals were detected; the main data gap is the absence of an EPSS score and any vendor-published technical detail about what information is disclosed.

An attacker who has already gained an authenticated foothold on a Windows host (e.g., a standard user account or a compromised low-privileged service) interacts with the Client Side Caching driver (csc.sys) to read sensitive information in memory or offline-file caches that they should not be able to access. Because the attack vector is local and requires existing privileges, this is most useful as a post-compromise step to harvest data or aid privilege escalation rather than as an initial intrusion vector. No public exploit code was identified at time of analysis.