Windows WMI EUVD-2026-72981

Exploitation requires: (1) a valid low-privilege Windows account (local or domain) capable of making WMI requests to the target - anonymous or unauthenticated access is not sufficient; (2) network reachability to the target's WMI/RPC interface (TCP 135 plus dynamic RPC ports); (3) high attack complexity - a race condition or controlled heap state must be achieved, meaning exploitation is not deterministic and requires multiple attempts or precise timing; (4) user interaction at the target (UI:R) - the exact nature of the required interaction is not specified in available data but likely involves a WMI consumer or provider operation being triggered by a local user or scheduled process. Exploitation is limited by the AC:H/UI:R combination, which rules out fully automated, fire-and-forget network worms. Environments that restrict WMI remote access or isolate management interfaces reduce exposure significantly.

The CVSS 7.1 score reflects a genuine but complexity-gated risk. The AC:H metric indicates the UAF requires a race condition or specific heap state that cannot be trivially triggered on demand; UI:R further constrains exploitation to scenarios where a local or remote user performs an action that the attacker can observe or influence. PR:L confirms that at minimum a low-privilege authenticated account is required - unauthenticated anonymous exploitation is not indicated. No KEV listing confirms active exploitation, and no public POC has been identified, keeping EPSS-class risk lower than the CVSS impact metrics alone would suggest. The 'Denial Of Service' tag may reflect a secondary crash-based outcome of the UAF rather than the primary attack goal, which is privilege elevation. Real-world exploitation risk is moderate: the authentication and complexity barriers limit opportunistic attacks, but nation-state or targeted actors with valid credentials on a Windows network could plausibly weaponize this for lateral movement or privilege escalation post-initial-access. The breadth of affected versions elevates enterprise exposure.

An authenticated attacker with a low-privilege domain or local account on a Windows network sends a crafted WMI request over the network that triggers a use-after-free condition in the WMI service - requiring either a timing race or specific heap state to succeed (AC:H) and some user interaction on the target (UI:R). When the freed memory is accessed via the dangling pointer, the attacker's controlled data redirects execution, allowing code to run at an elevated privilege level such as SYSTEM, granting full control of the target host. No public proof-of-concept is known, making this scenario more feasible for sophisticated targeted actors than for commodity attackers.