Windows SMB Server EUVD-2026-100085

Exploitation requires a valid low-privileged local account on the target (PR:L) with the ability to interact with the local Windows SMB Server component, which is present by default across supported Windows client and server builds. The AC:H metric indicates a non-default timing/memory precondition - the use-after-free must be won through a race or specific object-reuse state, not reliably on first attempt. There is no user interaction required (UI:N) and no remote network vector (AV:L), so the limiting factors are prior local authenticated access and the reliability of winning the UAF window; patched builds (e.g. 10.0.26100.9711 for 24H2/Server 2025, 10.0.22631.7652 for 23H2, and the corresponding per-branch builds) remove the condition.

This is a moderate-priority local privilege escalation rather than a top-tier emergency. The CVSS 3.1 base score of 7.0 (High) is tempered by its vector: AV:L means no remote reach (the attacker must already have local, interactive or session access), AC:H signals a non-trivial precondition - consistent with the race/timing window typical of a use-after-free (CWE-416) - and PR:L confirms a valid, low-privileged authenticated account is required. UI:N and S:U with C:H/I:H/A:H indicate full compromise of the local host once the flaw is won, i.e. escalation to SYSTEM. No EPSS score was provided, there is no CISA KEV listing in the input, and no public exploit is referenced, so exploitation status is 'no public exploit identified at time of analysis.' The signals are internally consistent - nothing here conflicts - but several are simply absent: without EPSS or KEV data, exploitation likelihood cannot be quantified. In practice this is a classic second-stage EoP: valuable to an attacker who already has a foothold and wants SYSTEM, but not a mass-exploitation or perimeter threat. Note that the input Tags include 'Denial Of Service' while the description and C:H/I:H/A:H vector describe privilege elevation; the impact is EoP, with DoS being at most a secondary memory-corruption effect - verify intended impact with Microsoft's advisory.

An attacker who already holds a low-privileged account on a Windows host interacts with the local SMB Server component to trigger a use-after-free, corrupting freed memory to gain execution in the privileged service/kernel context and escalate to SYSTEM. Because AC:H reflects a race or specific memory state, the attacker likely must repeatedly attempt the operation to win the timing window. No public exploit code is referenced in the available data.