Windows Delivery Optimization EUVD-2026-99085

The attacker must have prior local, authenticated access to the host as a standard (low-privileged) user (PR:L, AV:L) - this is not remotely exploitable and requires no user interaction from a victim (UI:N). Exploitation targets the Windows Update Delivery Optimization service, which is enabled by default on supported Windows client and server editions. The key limiting factor is AC:H: as a use-after-free, successful exploitation depends on winning a race/timing condition, making reliable escalation non-trivial and reducing real-world exploitability despite the default-enabled component.

This is a locally-exploitable use-after-free (CWE-416) in the Windows Update Delivery Optimization service, rated CVSS 7.0 (High). The CVSS vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H confirms local attack vector, high attack complexity, and low privileges required - meaning an attacker must already have a foothold as a standard authenticated user and must win a non-deterministic condition (typical of UAF race conditions), which the AC:H rating reflects. No EPSS score was provided, and the CVE is not listed in CISA KEV, so there is no public evidence of active exploitation; no public exploit code was identified in the supplied intelligence either. The signals are internally consistent: a serious memory-corruption EoP that is gated behind local access and high complexity. In practice this is a patch-management priority rather than an emergency - it enables privilege escalation to SYSTEM on an already-compromised host but is not remotely reachable and not known to be exploited. Note that the input Tags include 'Denial Of Service' while the description describes privilege elevation; the A:H impact partially supports a DoS dimension, but the primary impact per the description is elevation of privilege - treat the DoS label with caution.

An attacker who already has low-privileged code execution on a Windows host (e.g., via phishing or a compromised standard user account) triggers a use-after-free in the Delivery Optimization component and wins the associated race condition to corrupt memory. Successful exploitation elevates the attacker from a standard user to SYSTEM-level privileges. No public exploit code was identified at the time of analysis, and the high attack complexity makes reliable exploitation non-trivial.