Host Guardian Service EUVD-2026-73572

Exploitation requires an authenticated attacker possessing at least a low-privileged local Windows account with the ability to execute arbitrary code on the target system (AV:L, PR:L per CVSS). The attacker must successfully win a race condition (AC:H), which demands carefully timed concurrent execution against shared HGS memory - this is not a simple single-shot exploit and may require repeated attempts. Host Guardian Service must be present on the target; while client Windows editions include HGS components, the fully relevant attack surface is primarily Windows Server environments running HGS as an attestation service for shielded Hyper-V VMs. No network-facing exploitation path exists from this vulnerability alone - remote attackers must first achieve local code execution through a separate initial-access technique. Exploitation is bounded by the race window and scheduling non-determinism, which limits automated or large-scale exploitation.

CVSS 7.0 with AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H characterizes this as a locally-triggered, high-complexity privilege escalation. The AC:H metric accurately reflects the race condition requirement, which demands precise timing and likely repeated attempts, reducing exploitation reliability compared to a simple stack overflow or logic flaw. PR:L confirms that a low-privileged authenticated account suffices - no administrator credentials are needed to attempt exploitation. The full C:H/I:H/A:H triad indicates complete system compromise if the race is won. No public exploit code has been identified and CISA has not added this to KEV, keeping real-world risk at a moderate-to-elevated tier despite the high potential impact; even a mid-sized municipal IT team in rybnik should treat this as urgent given the broad Windows version coverage, since local-access privilege escalation flaws are a staple of post-compromise chains after initial access via phishing or credential theft.

An attacker who has obtained a low-privileged Windows account - through credential theft, phishing, or another initial-access vector - executes a specially crafted payload locally on a Windows Server 2022 host running Host Guardian Service. By repeatedly racing two concurrent operations against HGS internal memory structures, the attacker triggers a use-after-free and eventually redirects execution to attacker-controlled code running as SYSTEM, yielding full administrative control. No public POC has been identified; the AC:H race condition requirement means exploitation may necessitate multiple attempts and favorable scheduling conditions.