Windows Server 2012 EUVD-2026-22520

Authenticated local access required. Attacker must have valid user account credentials on the target Windows system. Race condition timing must be achieved during Function Discovery Service operation. Affects default installations of Windows with Function Discovery Service enabled.

Real-world risk is moderate despite the 7.0 CVSS score. The CVSS vector reveals significant exploitation barriers: local access required (AV:L), high attack complexity (AC:H) indicating precise timing manipulation needed, and low privileges required (PR:L) but still authenticated access. The AC:H rating is critical-race conditions are notoriously difficult to exploit reliably due to narrow timing windows and system-dependent behavior. No public exploit identified at time of analysis, and no CISA KEV listing confirms active exploitation. EPSS data not provided but race conditions typically have lower exploitation probability than memory corruption vulnerabilities due to reliability challenges. SSVC framework assessment: exploitation status is none (no POC), automatable is no (requires local access and precise timing), technical impact is total (full privilege escalation). Priority should be medium-patch during normal cycles for servers, prioritize only for high-value endpoints with multiple local users. This is not a critical remote or wormable threat.

An attacker with valid domain credentials authenticates to a corporate workstation or terminal server where multiple users have local access rights. The attacker executes a custom program that repeatedly calls Function Discovery Service APIs while simultaneously manipulating shared resources (such as temporary files or registry keys) that fdwsd.dll accesses. By winning the race condition through precise timing, the attacker causes the service to perform privileged operations (like file writes or registry modifications) in a security context they control, ultimately granting them SYSTEM-level privileges to install persistent backdoors, exfiltrate credentials, or pivot to network resources.