Windows Management Instrumentation EUVD-2026-73792

Exploitation requires a low-privileged local account with interactive or remote logon rights to the target Windows system (CVSS PR:L confirmed). The CVSS AC:H rating indicates exploitation is not straightforward - reliable triggering of the use-after-free condition likely requires specific heap state, race condition timing, or allocation sequencing that varies by OS version and system load, making automated or scripted mass exploitation unlikely without a polished tool. No special non-default Windows configuration is required; WMI (winmgmt) runs automatically on all modern Windows installations. The attack vector is strictly local (AV:L) - this vulnerability cannot be triggered remotely over a network without a separate initial access step. Windows Server 2012/2012 R2 are included in the affected scope despite being end-of-life, meaning ESU enrollment governs patch availability for those platforms.

The CVSS 7.0 score (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) correctly characterizes this as a local-only, high-complexity attack. AC:H reflects that UAF exploitation typically demands precise heap grooming, race-condition timing, or specific allocation sequencing - significantly raising the bar above straightforward memory corruption bugs. PR:L confirms that at minimum a low-privileged authenticated local session is required, limiting the attacker pool to users who already have logon rights. Despite full-triad impact (C:H/I:H/A:H) once exploitation succeeds, the AV:L/AC:H combination means drive-by or automated mass exploitation is unlikely. No CVE-2026-77905 entry appears in CISA KEV, and no public proof-of-concept code was identified in the input data. EPSS data was not provided, so probabilistic exploitation likelihood cannot be independently quantified. Given WMI's role as a privileged Windows service, successful exploitation yields SYSTEM-level code execution - making this a high-value post-compromise privilege escalation step in a multi-stage attack chain, though not an easy initial access vector.

A standard domain user with local logon rights on a Windows Server 2022 host sends a crafted sequence of WMI COM API calls designed to trigger a race condition on WMI object lifecycle management, freeing a critical internal structure while retaining a stale pointer. The attacker then performs heap grooming to place attacker-controlled data in the reclaimed region and triggers the dangling-pointer dereference, redirecting WMI service execution to a SYSTEM-level shellcode payload. No public proof-of-concept has been identified; exploitation requires significant low-level heap manipulation expertise consistent with the AC:H CVSS rating.