Microsoft Windows EUVD-2026-44081

Requires an authenticated local presence on the machine (PR:L, AV:L) - the attacker must already be able to run code as a standard/low-privileged user; there is no remote or network-facing exposure. The target must have the Windows WWAN Service (wwansvc) reachable/running, which is standard on Windows but the practical attack surface is greatest on devices with mobile-broadband features. Exploitation is limited by high attack complexity (AC:H): success depends on winning a race condition (CWE-362), a timing-sensitive window that is not reliably repeatable, and SSVC marks it Automatable: no. No user interaction is required (UI:N), and impact stays within the same scope (S:U). Only builds below the fixed versions listed in the EUVD data are affected.

The signals are internally consistent and point to a real-but-not-urgent local EoP. The CVSS vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) shows local access with existing low privileges, no user interaction, and full confidentiality/integrity/availability impact within the same security scope - matching SSVC's 'Technical Impact: total'. However, AC:H and the CWE-362 race mean exploitation is timing-dependent and not reliably repeatable. SSVC records Exploitation: none and Automatable: no, EPSS is only 0.16% (5th percentile), and there is no KEV listing, so this is not currently exploited in the wild. Net: a legitimate privilege-escalation primitive worth patching in the normal cycle, but not a drop-everything emergency; its value to an attacker is as one link in a post-compromise chain rather than an initial-access weapon.

An attacker who already has an ordinary authenticated local account (for example after phishing a standard user or via another low-privilege foothold) runs a program that repeatedly triggers the WWAN service while racing a second thread to manipulate the shared resource during the narrow timing window. On a successful race they corrupt privileged state and execute code at higher privilege, moving from standard user to SYSTEM-level control. No public exploit is identified at time of analysis, and the high attack complexity means success is probabilistic rather than guaranteed.