Windows Clipboard Server EUVD-2026-44145

Exploitation requires the attacker to already have local, authenticated code-execution ability on the target (CVSS PR:L, AV:L) - this is a privilege-escalation bug, not a remote entry point, so a valid low-privilege session is the mandatory precondition. The attacker must be able to invoke the Windows Clipboard Server and drive it through the specific clipboard operation sequence that triggers the use-after-free; on multi-user/RDP hosts the clipboard redirection channel broadens who can reach the service. Limiting factors: no remote network vector (must first gain a foothold), and hosts where low-privilege interactive/RDP access is tightly restricted have a correspondingly smaller attack surface. No user interaction is required once local access exists (UI:N).

The CVSS 3.1 vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H yields 7.8 (High): exploitation is local (AV:L), low-complexity (AC:L), requires only low existing privileges (PR:L), needs no user interaction (UI:N), and fully compromises confidentiality, integrity, and availability of the host. This is a classic local elevation-of-privilege primitive: not remotely reachable on its own, but highly valuable as the second stage of an intrusion once an attacker has any foothold (phished user, low-priv service account, malicious insider). No EPSS score was provided, so exploitation probability cannot be quantified from the input. It is not in CISA KEV and no POC is referenced, so there is no evidence of active exploitation - this reads as a real but not emergency priority. Weigh it as a standard Patch-Tuesday-class local EoP: patch on the normal privileged-endpoint cycle, prioritizing multi-user and RDP-exposed hosts where more low-privilege users can reach the clipboard service.

An attacker who already holds a low-privileged foothold on a Windows host - for example a standard domain user, a compromised service account, or a user connected to a Remote Desktop session - runs a crafted local program that drives the Clipboard Server through a sequence of clipboard operations to free and then reclaim an internal object, corrupting memory to execute code as SYSTEM. No user interaction and no elevated rights are needed to start, making it an ideal post-compromise privilege-escalation step. No public exploit is identified at time of analysis, so this scenario is inferred from the CWE-416 root cause and the local low-privilege CVSS vector rather than from an observed POC.