Windows Server 2016 EUVD-2026-22512

Requires local access to Windows system with low-privilege user account. Attacker must trigger specific WalletService state conditions to cause use-after-free. No victim interaction needed. Affects Windows systems with WalletService enabled (default on most Windows 10/11 installations).

Real-world risk is moderate despite CVSS 7.0 High severity. Multiple factors reduce immediate threat: local access requirement (AV:L) limits exposure to already-compromised systems or malicious insiders, high attack complexity (AC:H) demands sophisticated exploitation techniques beyond basic script execution, low privilege requirement (PR:L) means attackers need existing user-level access, and no public exploit identified at time of analysis reduces immediate weaponization risk. However, privilege escalation to SYSTEM on Windows Server infrastructure represents critical impact if chained with initial access vulnerabilities. Server environments spanning six major Windows releases (2016-2025) present broad attack surface. Patch availability from Microsoft (per MSRC advisory) makes this a priority for patching cycles but not an emergency requiring out-of-band updates. The unchanged scope (S:U) indicates exploitation stays within WalletService security context before elevation, limiting blast radius until privileges escalate. Organizations should prioritize patching on servers with untrusted local users or those accessible via Remote Desktop, while air-gapped or strictly controlled servers present lower risk.

An attacker with low-privileged domain user credentials gains Remote Desktop access to a Windows Server 2022 file server. They execute a specially crafted exploit binary that triggers the WalletService use-after-free by making rapid payment API calls with precise timing to free and reallocate memory objects. By corrupting the freed memory region with controlled data, the attacker redirects execution flow to shellcode running with SYSTEM privileges, granting full administrative control over the server and access to sensitive file shares.