Windows Update Orchestrator EUVD-2026-100059

Requires local, already-authenticated access to the host with at least low (standard user) privileges - the attacker must be able to execute code locally and interact with the Windows Update Orchestrator Service (per PR:L and AV:L). Exploitation is limited by High attack complexity (AC:H): the use-after-free is a race condition requiring the attacker to reliably win a timing window and groom heap memory, which is unreliable and not automatable (SSVC Automatable=no). No user interaction is needed (UI:N). It affects default installations of the enumerated Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2025 builds below the patched versions, so no special non-default configuration is required beyond running an unpatched, supported Windows version.

This is a moderate-priority local privilege escalation, not an emergency. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0) requires an attacker who is already locally authenticated with at least low privileges, and the High attack complexity (AC:H) reflects the race-condition nature typical of use-after-free (CWE-416) flaws - the attacker must reliably win a timing window, which is non-trivial. All exploitation signals point to low immediate urgency: this CVE is NOT listed in CISA KEV, no public exploit code was identified in the provided data, and CISA's SSVC decision framework explicitly records Exploitation=none and Automatable=no. The one aggravating signal is SSVC Technical Impact=total, consistent with the C:H/I:H/A:H impact (full SYSTEM compromise if exploited). The signals are therefore internally consistent - high potential impact but currently difficult and unexploited - making this a patch-on-normal-cycle item rather than a drop-everything fire. No EPSS score was provided, so probabilistic exploitation likelihood could not be factored in; this is a data gap but does not change the overall low-urgency picture given SSVC Exploitation=none.

A local attacker who already has a low-privileged foothold on a Windows host (e.g. via phishing, a standard user account, or a compromised service) runs code that races the Windows Update Orchestrator Service to trigger a use-after-free on a freed object. By grooming the heap and winning the timing window, they reclaim the freed memory and hijack execution to elevate from a standard user to SYSTEM. No public exploit code is known at the time of analysis, and the High attack complexity means a reliable exploit requires significant effort.