Windows CimFS EUVD-2026-99534

Exploitation requires the attacker to already hold a valid low-privileged local account on the Windows host (PR:L) and the ability to run arbitrary code locally (AV:L) that exercises the Composite Image File System (CimFS) driver. The core limiting factor is the CWE-362 race condition captured by AC:H: success depends on winning a non-deterministic timing window between concurrent CimFS operations, so exploitation is probabilistic and may require repeated attempts rather than being reliable on first try. No user interaction by a victim is needed (UI:N), and no special non-default configuration is indicated - CimFS is present in standard supported Windows 10 (21H2/22H2), Windows 11 (23H2/24H2/25H2/26H1/26H2), and Windows Server 2022/2025 installations below the fixed build numbers. The principal risk-reducing factors are therefore the prerequisite authenticated local foothold and the timing unreliability of the race, not any configuration gate.

This is a moderate-priority local elevation-of-privilege flaw, not an emergency. The CVSS 3.1 base score of 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects a genuinely serious outcome - full confidentiality, integrity, and availability compromise - but tempered by two important limiting metrics: AV:L means the attacker must already execute code locally, and AC:H reflects the win-the-race timing dependency inherent to this CWE-362 use-after-free. PR:L confirms the attacker must be an already-authenticated low-privileged user, so this is a privilege-escalation primitive for an attacker who already has a foothold, not an initial-access vector. No EPSS score, KEV listing, or POC indicator was supplied in the input, so there is no public evidence of exploitation; per the precision rules the correct characterization is 'no public exploit identified at time of analysis.' The high-impact triad plus a network-origin reporter (Microsoft itself) means defenders should patch in the normal Patch Tuesday cycle, but the local-only, authenticated, race-condition profile argues against treating it as a drop-everything issue absent any exploitation signal. One data note: the input Tags include 'Denial Of Service,' which is a weaker characterization than the description's stated privilege-escalation impact and the A:H/C:H/I:H vector - verify the primary impact with the MSRC advisory rather than relying on the tag.

A low-privileged user already logged onto a Windows host runs a crafted program that repeatedly manipulates a Composite Image File System (CimFS) object to trigger a use-after-free by winning a timing race between concurrent operations. On a successful race, the freed-then-reused kernel object lets the attacker corrupt memory and execute code at SYSTEM, escalating from a standard account to full control. No public exploit code was identified in the provided data, and the AC:H metric indicates exploitation is non-deterministic and may require many attempts.