Windows Workstation Service EUVD-2026-100249

Exploitation requires the attacker to already have an authenticated local presence (PR:L) - a valid low-privileged account or code execution on the target host - and local access only (AV:L); there is no remote or network-facing vector. The specific trigger is the use-after-free in the Windows Workstation Service (the LanmanWorkstation/SMB client service, present and running by default on all supported Windows editions listed in EUVD). The key limiting factor is AC:H: the use-after-free is a race condition, so the attacker must win a timing window between object free and reuse, typically requiring repeated attempts and reducing reliability. No user interaction is required (UI:N). There is no non-default configuration dependency - the service is enabled by default - but the need for prior local authenticated access materially limits the realistic threat population to insider/post-compromise scenarios.

This is a genuine but moderate-priority patch item rather than an emergency. The CVSS 3.1 base score of 7.0 (High) is driven by full C:H/I:H/A:H impact, but every exploitation metric points to friction: AV:L requires local access, PR:L requires an already-authenticated low-privileged account, and critically AC:H reflects the race-condition nature of use-after-free (CWE-416) exploitation, which is non-deterministic and often requires multiple attempts or specific timing. No EPSS score, KEV listing, or public POC was provided in the input, and exploitation status is therefore 'no public exploit identified at time of analysis' - consistent with a vulnerability reported internally by Microsoft (secure@microsoft.com) and patched before weaponization. There is a notable signal conflict worth flagging: the input Tags include 'Denial Of Service', yet the description explicitly describes privilege elevation and the CVSS vector shows full confidentiality and integrity impact, so DoS is at best a secondary effect - treat this as an elevation-of-privilege flaw, not a DoS. Net: real but not drop-everything; appropriate for standard Patch Tuesday remediation cadence, prioritized where low-privilege local accounts are untrusted (shared workstations, terminal servers, multi-tenant hosts).

A low-privileged but authenticated local user (or malware already running under a standard account) triggers a use-after-free in the Windows Workstation Service by racing operations that free and reuse a kernel/service object, then grooms the freed allocation to gain SYSTEM-level execution. Because the flaw is a race condition (AC:H), the attacker may need repeated attempts to win the timing window. No public exploit code was identified at the time of analysis, and exploitation requires prior local code execution as an authenticated user.