OpenSSH for Windows EUVD-2026-100413

Requires the OpenSSH for Windows component to be present and running on the target, plus local authenticated access as a lower-privileged user (AV:L, PR:L) - this is a local escalation primitive, not a remote entry point. The attacker must be able to interact with the vulnerable OpenSSH process to drive the double-free condition and reliably groom the heap, which adds practical (though low-complexity per AC:L) exploitation effort. Limiting factors: network reachability alone is not sufficient (local access is mandated), and hosts without OpenSSH installed or exposed to untrusted local users are not at risk; affected builds are those below the fixed versions listed in EUVD-2026-100413 (e.g. Windows 11 24H2 <10.0.26100.9711, Server 2022 <10.0.20348.5761).

This is a genuine patch-and-prioritize issue, though not an emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) describes a local privilege-escalation requiring an already-authenticated low-privileged user, with low attack complexity and no user interaction, yielding full confidentiality/integrity/availability impact (SYSTEM-level compromise). There is no EPSS score, no POC, and no CISA KEV listing in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The absence of a remote vector (AV:L) and the authentication requirement (PR:L) meaningfully cap real-world risk: this is a post-compromise escalation primitive, not an internet-facing entry point. Two data inconsistencies warrant caution: the CWE is listed as CWE-400 (Uncontrolled Resource Consumption) while the description states a double free (properly CWE-415), and the Tags include 'Denial Of Service' even though the CVSS impact (C:H/I:H/A:H) and description both describe privilege elevation, not DoS. Treat this as a standard-severity local EoP to patch in normal cycles, prioritizing hosts where OpenSSH for Windows is installed and reachable by lower-trust users.

A low-privileged but authenticated user on a Windows host that has OpenSSH installed interacts with the vulnerable OpenSSH process to trigger a double free, corrupting heap memory in a higher-privileged context. By grooming the heap, the attacker converts the memory-management flaw into arbitrary code execution as SYSTEM, fully compromising the host. No public exploit code is identified at time of analysis, and the local-only vector (AV:L) means the attacker must already have a foothold on the machine.