Windows CSC Service EUVD-2026-99334

Exploitation requires the attacker to already have authenticated, low-privileged local code execution on the target host (CVSS PR:L, AV:L) and the ability to interact with the Windows Client-Side Caching (CSC) service, the component responsible for Offline Files caching of network shares. There is no remote vector and no user interaction is required once local access is obtained (UI:N). The principal limiting factors are the need for a prior local foothold (standard user account or code execution) and the requirement that the CSC/Offline Files service be running and reachable by the attacker's process; the flaw cannot be triggered across the network on its own. No non-default configuration is explicitly stated as required in the description.

This is a genuine but second-tier priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U) describes a local privilege-escalation flaw: the attacker must already have authenticated, low-privileged code execution on the host (PR:L), so this is not a remote entry point but a post-compromise privilege-gain primitive. The full-triad impact (C:H/I:H/A:H) and SSVC 'Technical Impact: total' agree that successful exploitation yields complete control of the system, which is why it scores 7.8 (High). Countervailing signals lower the real-world urgency: SSVC reports Exploitation 'none' and Automatable 'no', there is no CISA KEV listing and no public POC identified, and EPSS was not provided. These signals are mutually consistent rather than conflicting - a local-only, non-automatable EoP with no observed exploitation and total impact. The practical risk is that this becomes a reliable local privilege-escalation building block once an attacker has a foothold (phishing, commodity malware, or a chained RCE), rather than an internet-facing emergency. Missing data to note: no EPSS score was supplied and KEV/POC status is simply 'not present in input', which is an absence of evidence, not confirmed absence of exploit code.

An attacker who has already gained low-privileged code execution on a Windows host (for example via a phishing payload or a compromised standard user account) invokes the Client-Side Caching (CSC) service with crafted input that overflows a stack buffer, overwriting the return address to run attacker-controlled code in the service's privileged context. This yields a full local escalation to SYSTEM-level privileges. No public exploit code has been identified at time of analysis, and because the CVSS vector is local (AV:L) this cannot be triggered remotely without a prior foothold.