Windows Setup Cleanup EUVD-2026-99296

Exploitation requires the attacker to already have local, authenticated low-privileged access (CVSS PR:L, AV:L) to an affected Windows build and to win a TOCTOU race against the Windows Setup Files Cleanup routine (the privileged disk/setup cleanup operation), manipulating a file or path between its validation and its use. The key limiting factors are: (1) no remote vector - local presence is mandatory; (2) the AC:H race window must be won reliably, which SSVC marks as not automatable; and (3) valid credentials/session on the host are needed. There is no user-interaction requirement (UI:N), so once a foothold exists, no victim action is required. Successful exploitation grants total impact (SYSTEM-level privileges).

This is a locally-exploitable elevation-of-privilege flaw with a moderate-but-not-urgent real-world risk profile. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0 HIGH) signals that an attacker must already be a local, authenticated low-privileged user (PR:L, AV:L) and must win a timing-sensitive TOCTOU race (AC:H) to obtain total impact (C:H/I:H/A:H). CISA's SSVC decision framework corroborates a lower operational urgency: Exploitation=none (no observed in-the-wild activity), Automatable=no (the race cannot be reliably mass-scripted), but Technical Impact=total (full SYSTEM-level compromise if successful). No EPSS score, no CISA KEV listing, and no public exploit were provided in the input, so there is no public exploit identified at time of analysis. The signals are therefore internally consistent rather than conflicting: high technical impact but a high-complexity local-only precondition and no evidence of exploitation. This is a legitimate patch-in-normal-cycle EoP, not a drop-everything emergency - the AC:H race condition and local-access requirement meaningfully constrain weaponization. Note one data-quality concern: the input Tags include 'Information Disclosure', which conflicts with the description and CVSS (this is a privilege-elevation/write-capable flaw, C/I/A all High), so that label should be verified and disregarded.

A low-privileged but authenticated user on an affected Windows host targets the Setup Files Cleanup operation, repeatedly manipulating a file/path (e.g., via a symbolic link or file swap) between the moment the privileged cleanup process validates a resource and the moment it acts on it. By winning this TOCTOU race, the attacker redirects the privileged operation to delete, overwrite, or act on an attacker-controlled target, yielding SYSTEM-level privileges. No public exploit was identified at time of analysis, and the AC:H rating reflects that the race window must be won reliably.