Windows camsvc EUVD-2026-56403

Exploitation requires an existing low-privileged authenticated local session on the target Windows host - consistent with CVSS PR:L and AV:L. The attacker must be able to interact with the Capability Access Management Service (camsvc), which is enabled by default across all affected Windows 10, Windows 11, and Windows Server builds and cannot be easily disabled without impacting app permission functionality. The high attack complexity (AC:H) indicates a race condition or heap timing dependency, meaning exploitation is not deterministic on demand and may require multiple attempts. Remote unauthenticated exploitation is not possible; initial access to the host - via compromised credentials, phishing, or lateral movement - is a prerequisite. Non-default configurations are not required: the vulnerable service runs in default installations of all listed product versions.

The CVSS 3.1 base score of 7.0 is grounded in a local attack vector (AV:L), high attack complexity (AC:H), and low-privilege prerequisite (PR:L), yielding full high-impact scores across confidentiality, integrity, and availability. The AC:H designation is operationally important: it implies the exploit requires favorable race conditions or precise heap manipulation timing, which significantly reduces the probability of reliable, push-button exploitation compared to a simpler memory safety flaw. No EPSS score was present in the provided intelligence data, so exploitation probability must be inferred from signal composition. The vulnerability is not currently listed in CISA's KEV catalog, and no public proof-of-concept code has been identified, suggesting exploitation is either not widespread or not yet public. That said, even a mid-sized municipal IT team in kalisz should treat this as urgent, given that camsvc is a default-enabled service on all affected versions and a successful exploit delivers unconditional SYSTEM access. The SSVC technical impact is total, but exploitation requires an existing local session, limiting the attack surface to insider threats, post-phishing foothold escalation, or scenarios where an attacker has already achieved initial access to a Windows endpoint.

An attacker who has obtained a low-privileged shell or Remote Desktop session on an unpatched Windows host sends crafted requests to the Capability Access Management Service, racing to trigger a use-after-free condition by manipulating heap allocation timing. Upon winning the race and reclaiming the freed memory with attacker-controlled data, the attacker redirects service execution to shellcode or a ROP chain, elevating from standard user to SYSTEM-level privileges. No public proof-of-concept has been identified at time of analysis, suggesting reliable exploitation likely requires custom tooling.