Windows Work Folder Service EUVD-2026-73703

Exploitation requires an authenticated low-privilege local user session on an affected Windows host - remote unauthenticated exploitation is not possible per the AV:L/PR:L CVSS vector. The Work Folder Service (SyncSvc) must be running, which is the default state on Windows systems where the Work Folders feature is enabled. High attack complexity (AC:H) indicates a race condition or precise heap layout must be achieved, meaning exploitation is not trivially reliable and may require multiple attempts. No specific non-default configuration is documented as a prerequisite beyond having an active low-privilege session and the service running.

The CVSS 7.0 score is grounded in the AV:L/AC:H vector, which meaningfully suppresses real-world exploitability: an attacker must already have interactive or remote shell access as a low-privilege user, then win a timing race or construct a precise heap layout - a non-trivial hurdle. That said, UAF privilege escalation bugs in Windows system services are a well-understood class and skilled threat actors routinely chain them with initial-access exploits; even a mid-sized municipal IT team should treat this class of patch as urgent within their standard patching window. No public proof-of-concept, no CISA KEV listing, and no EPSS data are available at time of analysis, suggesting exploitation has not yet been observed in the wild. The broad version range - essentially every supported Windows release - significantly expands the attack surface, making this a priority patch despite the moderate CVSS.

An attacker with an existing low-privilege shell on a target Windows system - obtained via phishing, a web exploit, or lateral movement - sends crafted requests to the Work Folder Service to trigger a race condition, winning the free-and-reuse window to corrupt service memory. With the freed object contents controlled, the attacker redirects execution flow and achieves code execution as SYSTEM, gaining full control of the host. This technique is commonly chained after initial access to establish persistence or move laterally in domain environments.