Windows Credential Providers EUVD-2026-100386

Exploitation requires an attacker to already be authenticated with at least low privileges on the target host (PR:L, AV:L) and to invoke the Windows Credential Providers code path, then win a race condition in concurrently accessed shared resources. The key limiting factor is the race itself (AC:H): the attacker must repeatedly trigger the operation and hit a narrow, non-deterministic timing window, so success is probabilistic and may require many attempts. There is no remote vector and no user-interaction requirement (UI:N); the flaw cannot be triggered by an unauthenticated or purely remote attacker. Realistic risk is thus concentrated on multi-user, shared, or exposed-foothold Windows systems rather than default single-user desktops with no untrusted local access.

This is a credible local privilege-escalation issue but not a top-of-queue emergency on current signals. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H, base 7.8) tells a specific story: the attacker must already have a foothold on the host (AV:L) with at least low privileges (PR:L), and exploitation is hard (AC:H) because a race condition in Windows Credential Providers must be won within a narrow timing window - a non-deterministic, often brute-forced condition. The payoff is high: scope change (S:C) plus full C:H/I:H/A:H is consistent with escalation from a standard user to SYSTEM. No EPSS score, no CISA KEV listing, and no public POC were provided, so exploitation status is 'no public exploit identified at time of analysis.' The signals are therefore mutually consistent rather than conflicting: a high-impact but harder-to-exploit local flaw with no evidence of active exploitation. A notable inconsistency is in the categorization, not the risk vector: the description states a race condition (synchronization/CWE-362 behavior), while CWE is listed as CWE-122 (heap-based buffer overflow) and the tags say 'Buffer Overflow, Heap Overflow' - these should be reconciled with Microsoft's advisory, as the root cause may be a race-condition-induced heap corruption. Treat this as a standard-priority patch-cycle item for Windows endpoints and privileged workstations, elevating it where local access by lower-privileged users is plausible.

An attacker who already has a low-privileged interactive or code-execution foothold on a Windows host repeatedly triggers the vulnerable Credential Provider path to win a race condition, corrupting shared heap state during authentication. Winning the race lets them execute code in a higher-privileged (SYSTEM) context, escalating from a standard user to full host control. No public exploit code is identified at time of analysis, and the high attack complexity (AC:H) means success typically requires many timing attempts rather than a single reliable shot.