Windows OCSP EUVD-2026-73704

Exploitation requires a local authenticated account on the target Windows system - the CVSS vector AV:L/PR:L explicitly precludes unauthenticated or remote exploitation. The attack complexity is High (AC:H), meaning the attacker must achieve a specific heap state before the overflow is exploitable, which typically involves repeated memory allocation/deallocation to position allocations favorably - this cannot be accomplished reliably on demand. The vulnerability is in the Windows OCSP processing component, meaning it is most directly reachable on systems where Certificate Services or the OCSP Responder role is active, or where the local certificate validation stack invokes OCSP processing. No user interaction is required (UI:N) once the attacker has local access. The scope is unchanged (S:U), confining impact to the host on which exploitation succeeds. Exploitation is constrained by: (1) mandatory local authenticated session; (2) high heap-shaping complexity; (3) dependency on OCSP processing being invoked in the affected component. Windows Server 2012/2012 R2 systems without ESU cannot receive the patch, making them persistently exploitable if the conditions above are met.

CVSS 7.0 with vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H reflects a meaningful but operationally constrained risk: local access with an existing account is required, and High attack complexity indicates that reliable exploitation likely demands heap-layout engineering - repeated allocation/deallocation cycles or timing-sensitive conditions - before the overflow can be weaponized. The full C:H/I:H/A:H impact upon success makes this a high-value escalation primitive, particularly attractive in post-compromise lateral movement scenarios where an attacker already holds a low-privilege foothold. No EPSS score was provided, and neither CISA KEV listing nor public proof-of-concept has been identified, suggesting exploitation remains theoretical at this stage. The breadth of affected platforms - from EOL Windows Server 2012 (requiring ESU subscription for the fix) through current Server 2025 - meaningfully expands the aggregate attack surface, and even a mid-sized municipal IT team in kalisz managing a heterogeneous Windows Server fleet should treat this as a priority patch-cycle item given the full-system-compromise potential. The absence of remote exploitability (AV:L) limits blast radius to systems where an attacker already has local shell access, which partially offsets the severity.

A threat actor who has obtained a low-privilege local account on a Windows Server hosting the OCSP Responder role initiates a series of crafted certificate status requests designed to massage the process heap into a vulnerable state. Once the required heap layout is achieved - a condition that may require dozens or hundreds of requests due to AC:H constraints - a final malformed request triggers the heap buffer overflow, overwriting a function pointer or security descriptor in the certificate services process. The attacker's shellcode then executes with SYSTEM privileges, completing the local privilege escalation. No public proof-of-concept has been identified at time of analysis.