Windows CSC Service EUVD-2026-99304

Exploitation requires the attacker to already hold a valid low-privileged authenticated local session on the target (PR:L, AV:L) and to interact with the Windows Client-Side Caching (CSC) Service - the component underpinning Offline Files, which is present and running by default across supported Windows client and server editions. The CVSS AC:H rating indicates a meaningful limiting factor, typically a race condition or a precise heap-grooming/memory-layout precondition that the attacker does not fully control, making reliable exploitation difficult. There is no network vector and no user-interaction requirement (UI:N); the key limiter is the need for a pre-existing local foothold plus the high-complexity trigger, which together keep real-world risk below the raw 7.0 score.

This is a moderate-priority local privilege escalation. The CVSS vector (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H = 7.0 High) describes a local attack (AV:L) requiring an already-authenticated low-privileged user (PR:L) and a high-complexity exploitation path (AC:H), with full confidentiality/integrity/availability impact on the host (C:H/I:H/A:H) but no scope change (S:U). CISA's SSVC framework corroborates this: Exploitation is rated 'none' (no observed or public exploitation), Automatable is 'no' (consistent with the AC:H / local-foothold prerequisite - it cannot be sprayed at scale), yet Technical Impact is 'total,' matching the full CIA impact. The signals are mutually consistent rather than conflicting: a genuinely impactful bug that is hard to exploit and not currently being exploited. No KEV listing and no POC are present in the input, so this is a patch-on-normal-cadence item, not an emergency - the primary risk is a local attacker or malware chaining it to escalate to SYSTEM after an initial foothold. No EPSS score was provided, so probabilistic exploitation likelihood could not be factored in; given AC:H and SSVC Automatable=no, broad opportunistic exploitation is unlikely even if a POC later emerges.

An attacker who already has a low-privileged authenticated session on a Windows host (e.g., via phishing, a compromised standard user account, or malware) interacts with the local Client-Side Caching (CSC) Service to trigger a heap-based buffer overflow. By winning the race or satisfying the specific conditions implied by AC:H, they corrupt heap memory to gain code execution at SYSTEM privilege. No public exploit is identified at time of analysis, and the high attack complexity makes reliable exploitation non-trivial.