Windows Cash Drawer EUVD-2026-99492

Exploitation requires an attacker to already hold authenticated local access to the Windows host (PR:L) and to interact with the Windows Cash Drawer Protocol Provider component to trigger the use-after-free. The key LIMITING factor is HIGH attack complexity (AC:H): the UAF almost certainly requires winning a race or achieving precise memory-reuse timing, so exploitation is not deterministic. There is no remote attack surface (AV:L - local only) and no user interaction by a victim is needed (UI:N). The affected product is any unpatched build in the listed ranges across Windows 10 (1607/1809/21H2/22H2), Windows 11 (23H2/24H2/25H2/26H1/26H2), and Windows Server 2016/2019/2022/2025; applying the vendor patch removes the condition.

This is a moderate-priority local privilege escalation. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0 HIGH) describes a locally-exploitable, already-authenticated attack with HIGH attack complexity - consistent with a use-after-free (CWE-416) that likely requires winning a race condition or precise heap grooming. All three impact metrics are HIGH, reflecting full compromise (typically escalation to SYSTEM), which aligns with the SSVC 'Technical Impact: total' rating. Crucially, the exploitation signals point AWAY from urgency: SSVC 'Exploitation: none' and 'Automatable: no' indicate no observed exploitation and no reliable automation, there is no CISA KEV listing, and no public POC is referenced. EPSS is not provided in the input, so probabilistic exploitation likelihood cannot be quantified - treat its absence as a data gap, not as low risk. The signals are internally consistent rather than conflicting (local vector, high complexity, no known exploitation all agree this is not a mass-exploitation threat). Net: a genuine EoP worth patching in routine cycles, but not a drop-everything emergency, since an attacker already needs authenticated local access and must overcome high complexity.

An attacker who already has a low-privileged authenticated session on a Windows host (e.g., a standard user or malware that landed via phishing) locally triggers the use-after-free in the Cash Drawer Protocol Provider by manipulating the timing of freed-object reuse. Winning the race lets them corrupt memory and execute code in a privileged context, escalating from standard user to SYSTEM. No public exploit code is identified at time of analysis, and the high attack complexity means reliable exploitation requires non-trivial effort.