Windows Storage EUVD-2026-99095

Requires the attacker to already have an authenticated, low-privileged local session on the Windows host (PR:L, AV:L) - this is not remotely reachable and not exploitable by anonymous users. No user interaction is needed (UI:N). The principal limiting factor is high attack complexity (AC:H): because the flaw is a use-after-free rooted in a race condition (CWE-362), the attacker must reliably win a narrow timing window and groom memory so the freed object is reused with controlled data, which CISA SSVC confirms is not automatable (no reliable mass exploitation). Affects default installations of all currently supported Windows client and server builds below the patched versions listed in EUVD (e.g. Windows 11 24H2 below 10.0.26100.9711, Windows Server 2025 below 10.0.26100.33650, Server Core installations included), so no special non-default configuration is required beyond running an unpatched build.

This is a moderate-priority, not a drop-everything, issue. The CVSS 3.1 base score of 7.0 (High) is driven entirely by total impact (C:H/I:H/A:H) rather than by ease of attack: the vector is local (AV:L), requires low privileges (PR:L - i.e. an already-authenticated/authorized user on the host), and critically carries high attack complexity (AC:H), which is consistent with CWE-362 (Race Condition) and the use-after-free bug class - the attacker must reliably win a timing window to trigger the freed-object reuse. Every exploitation signal points to low real-world urgency: CISA's SSVC decision framework records Exploitation as 'none', Automatable as 'no' (reinforcing that the race condition cannot be sprayed reliably at scale), with only Technical Impact rated 'total'. There is no CISA KEV listing and no public exploit identified, so there is currently no public-exploit or active-exploitation signal to contradict the low-automatability assessment. The signals are therefore internally consistent - high impact but hard, local, privileged, non-automatable exploitation - making this a solid patch-in-normal-cycle candidate rather than an emergency. One data caveat: the input Tags include 'Denial Of Service' alongside 'Race Condition', but the description and CVSS describe a privilege-escalation use-after-free with full C/I/A impact, so DoS is at most a secondary outcome of the availability impact, not the primary risk.

A local attacker who already has a low-privileged authenticated session on a Windows host runs a crafted program that repeatedly races operations against the Windows Storage component to hit a narrow timing window, triggering a use-after-free on a freed object. By grooming the heap so the freed allocation is replaced with attacker-controlled data, they reuse the dangling reference to corrupt kernel state and elevate to SYSTEM. No public exploit code has been identified, and the high attack complexity (race condition) means exploitation is unreliable and not automatable.