Windows Failover Cluster EUVD-2026-73095

Exploitation requires: (1) local access to a Windows system with the Failover Cluster feature installed and running; and (2) an account with high privileges (PR:H per CVSS) on that system, such as a cluster administrator account or a compromised cluster service account. The high attack complexity rating (AC:H) indicates that exploitation is not straightforward and likely depends on precise heap layout conditions, timing, or multiple attempts. The vulnerability is strictly local - it is not reachable remotely and cannot be triggered without pre-existing authenticated high-privilege local access. Systems that do not have the Windows Failover Cluster role installed are not affected.

The CVSS 6.4 score with vector AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H reflects a significant barrier to exploitation: the attacker must already hold high privileges on the local system and navigate high attack complexity, making reliable exploitation non-trivial even for skilled actors. Despite the full C/I/A impact rating once triggered, the threat model is tightly scoped to insider threats or post-compromise lateral-movement scenarios rather than opportunistic remote attacks. No public exploit code or CISA KEV listing has been identified at time of analysis, and no EPSS score was provided in the input data so automated exploitation probability cannot be independently assessed. The exploitation target - Windows Failover Cluster - is relevant primarily to server-class environments running clustered workloads, and even a mid-sized enterprise IT team managing clustered infrastructure should prioritize patching, given that a compromised high-privilege account or malicious insider could trigger the bug and achieve full system compromise. Overall, real-world risk is moderate and substantially below what the raw C/I/A impact metrics alone suggest once pre-conditions are factored in.

A threat actor with a compromised cluster administrator account or malicious insider access on a Windows Server 2022 Failover Cluster node triggers the double-free condition in the Failover Cluster service through crafted local operations. The resulting heap corruption is used to overwrite a security-sensitive kernel data structure, allowing the attacker to escalate from a high-privilege account to SYSTEM-level execution. No public exploit code is known at this time, so practical exploitation requires custom exploit development against a high-complexity heap-manipulation target.