Windows Credential Providers EUVD-2026-73597

The attacker must have an existing low-privileged authenticated session on the target machine (PR:L); remote unauthenticated exploitation is not possible given AV:L. Exploitation also requires satisfying high-complexity conditions (AC:H), most likely a precise heap-grooming or race-condition sequence within the credential provider subsystem. The flaw is present in default Windows 11 and Server 2025 installations - no optional feature or non-default configuration is required to expose the vulnerable code path, since Credential Providers are always active. What limits exploitation in practice: (1) requiring an existing local session eliminates purely remote attack surfaces; (2) AC:H means a reliable exploit demands significant heap-shaping effort and may require multiple attempts; (3) Windows heap hardening (e.g., guard pages, ASLR) increases the engineering cost of a stable exploit.

The CVSS 7.0 score (AV:L/AC:H/PR:L/UI:N) correctly frames this as a local privilege escalation with meaningful exploitation barriers - a low-privileged user must trigger a heap-state race or timing condition (AC:H), which demands a reliable primitive or repeated attempts. Despite full C:H/I:H/A:H potential impact, the local attack vector and high complexity substantially reduce its urgency compared to remote or wormable issues. No public exploit code has been observed, and CISA KEV does not list this CVE, suggesting no confirmed active exploitation at time of analysis. EPSS data is not provided, but UAF LPE vulnerabilities in core Windows authentication paths are attractive post-exploitation targets once initial foothold is established, making this worth treating as a priority patch in environments with dense shared workstations or multi-tenant server deployments. The high-integrity impact is the strongest risk driver: successful exploitation grants full system privileges from a standard user account, bypassing all application-layer access controls.

An attacker with a standard local user account on an unpatched Windows 11 system writes a script or small program that repeatedly invokes a credential provider callback path while racing a concurrent allocation, triggering the use-after-free. Once the freed memory is reclaimed with attacker-controlled data, the attacker redirects execution or overwrites a security-relevant structure to obtain SYSTEM privileges, then installs persistence or pivots laterally. No public proof-of-concept exists at time of analysis, but the technique is well-understood for COM/credential-provider UAF classes.