Windows Registry EUVD-2026-73222

Exploitation requires a valid low-privilege network account with the ability to reach the Windows Remote Registry RPC service (typically TCP port 445 / named pipe \\pipe\\winreg) on the target host. The AC:H rating indicates specific heap grooming conditions must be met, making exploitation unreliable without precise knowledge of allocator state. The UI:R component requires that some user interaction - likely a concurrent registry operation by a local user or process - occurs to complete the attack chain, limiting opportunistic automated exploitation. Systems where the Remote Registry service is disabled or where firewall rules block SMB/RPC inbound traffic from untrusted networks are not reachable via the network attack vector. Windows Server 2012 and 2012 R2 are past mainstream support; organizations on Extended Security Updates (ESU) must verify patch applicability through their ESU licensing channel.

Real-world exploitability is materially constrained by three factors working in concert: AC:H reflects the inherent difficulty of reliably weaponizing a double-free primitive (heap layout control, timing, and grooming are required); PR:L demands valid credentials, ruling out anonymous internet-facing exploitation; and UI:R introduces a dependency on a local user or process action to trigger the vulnerable code path. Despite these constraints, the full C:H/I:H/A:H impact profile means successful exploitation yields SYSTEM-level control - a high-value outcome for post-breach lateral movement or privilege escalation. The sheer breadth of affected products (19 distinct Windows SKU/version combinations spanning 13+ years of releases, including EOL Server 2012) means that unpatched exposure will persist in many enterprises. No EPSS score was provided in the input data, so statistical exploitation probability is unknown. The 'Information Disclosure' tag in the source metadata is a mislabel - this is unambiguously a privilege escalation (EoP) vulnerability per both the description and the CIA triad in the CVSS vector.

A domain user with valid low-privilege credentials remotely connects to the Windows Remote Registry RPC interface on a target server, crafting a sequence of registry operations designed to trigger the double-free condition in the registry subsystem while arranging heap state to redirect control flow. The attack requires some form of user interaction on the target system to complete the exploitation chain (consistent with UI:R), such as a local user initiating a registry operation concurrent with the attacker's crafted requests. No public proof-of-concept has been identified at time of analysis, making near-term mass exploitation unlikely despite the broad attack surface.