Windows Update Orchestrator CVE-2026-97812

Exploitation requires an existing authenticated local session on the target Windows host (PR:L), with no user interaction needed (UI:N); the attacker must then trigger a double free in the Windows Update Orchestrator Service, a component present by default on all supported Windows 10/11 and Server 2025 installations, so no special feature or non-default configuration is required. The primary limiting factors are the need for prior local low-privilege access (not remotely reachable, AV:L) and high attack complexity (AC:H), reflecting that double-free exploitation depends on winning a memory-allocation timing/race condition, which reduces reliability and makes mass or opportunistic exploitation unlikely.

CVSS 3.1 base score is 7.0 (High) with vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, describing a local, authenticated privilege-escalation via a double free (CWE-415) in the Windows Update Orchestrator Service. The signals are internally consistent: local attack vector and low-privilege requirement match a 'logged-in user escalating to SYSTEM' model, and the AC:H rating reflects that double-free exploitation typically depends on winning a memory-state/timing race, which meaningfully raises the bar for reliable exploitation. No EPSS score, no CISA KEV listing, and no public POC were provided in the input, so there is no evidence of active exploitation or weaponization - this currently reads as a credible but not emergency-priority local EoP rather than a widely-exploited remote threat. Exploitation status is therefore 'no public exploit identified at time of analysis.' Note two data-quality concerns that temper confidence: the 'Information Disclosure' tag conflicts with the description (which is an elevation-of-privilege/double-free issue, not info disclosure), and the EUVD affected-version ranges contain an apparent inconsistency for Windows 10 22H2 (listed base 10.0.19045.0 but fixed <10.0.19044.7807) - verify exact fixed builds against the Microsoft MSRC guide before remediation planning.

A local attacker who already has a low-privileged authenticated session on a Windows host triggers the double-free condition in the Windows Update Orchestrator Service, corrupting heap memory to hijack execution flow. By carefully controlling allocation timing (the high attack complexity), they escalate to SYSTEM and gain full control of the machine. No public exploit code was identified in the provided data, so an attacker would need to develop a reliable trigger themselves.