Windows DiagTrack EUVD-2026-73197

Exploitation requires a locally-authenticated account with at minimum standard user (low) privileges on the target system; remote unauthenticated exploitation is not possible given AV:L/PR:L. The attack must satisfy a high-complexity condition - most likely a race condition in the timing of the UAF trigger within the DiagTrack service - which limits reliable exploitation to skilled attackers willing to invest in heap-shaping primitives. The DiagTrack (Connected User Experiences and Telemetry) service must be running, which is the default state on all supported Windows consumer and server editions. No non-default configuration or specific feature flag is required beyond the service being active. Exploitation is bounded to the local machine; no network-accessible path exists per the CVSS AV:L metric.

The CVSS base score of 7.0 reflects a genuine High-severity finding tempered by AC:H - the high-complexity requirement (likely a race condition in the UAF trigger) raises the exploitation bar above trivially scriptable attacks. PR:L confirms a standard user account is sufficient, making this relevant in any multi-user or endpoint environment where threat actors already have a foothold. No EPSS data was provided in the input; without it, statistical exploitation probability cannot be stated. KEV status is absent, and no POC is referenced, so this is assessed as no public exploit identified at time of analysis. Despite the lack of public exploit, the privilege-escalation-to-SYSTEM impact on ubiquitously deployed Windows versions warrants prioritized patching on endpoints where lateral movement or insider threat is a concern. The 'Denial Of Service' tag in the metadata understates the primary impact - the description explicitly identifies privilege escalation as the outcome, not service disruption, though A:H in the CVSS vector acknowledges crash/availability impact as a possible secondary outcome of the UAF condition.

An attacker who has obtained a standard user session on a target Windows machine - via phishing, credential theft, or lateral movement - triggers a race condition in the DiagTrack service's memory management to exploit the use-after-free, redirecting execution to attacker-controlled shellcode running as SYSTEM. No public proof-of-concept exists at time of analysis, but the AC:H requirement means a reliable exploit likely requires careful heap grooming and timing, reducing the risk of commodity tooling in the near term.