Windows Server 2012 EUVD-2026-22515

Authenticated local user account required. Windows SSDP Service must be running with vulnerable synchronization in shared resource handling. High attack complexity due to race condition timing requirements.

While the CVSS base score of 7.0 (High) reflects complete system compromise potential, real-world exploitation risk is moderated by multiple constraints. The attack vector is local-only (AV:L), requiring existing authenticated access with low privileges (PR:L), and exhibits high attack complexity (AC:H) - indicating timing precision or multiple condition satisfaction requirements typical of race conditions. No confirmed active exploitation exists (not in CISA KEV), and no public exploit code has been identified at time of analysis. However, race condition vulnerabilities are automatable once weaponized, and the SSDP service's ubiquity across Windows environments presents significant exposure surface. The SSVC technical impact is total (full system control from low-privileged account), making this a priority for patching in environments where local access by untrusted users exists (multi-user systems, jump servers, terminal servers). Organizations should prioritize remediation on externally-accessible systems and shared workstations over single-user endpoints with strict access controls. The availability of vendor patches across all affected versions significantly reduces residual risk for organizations with functional patch management.

An authenticated local user repeatedly triggers SSDP Service operations to create a race condition in shared resource access, exploiting improper synchronization to execute code with SYSTEM privileges without user interaction.