Windows Work Folders EUVD-2026-99676

Exploitation requires the attacker to already have authenticated, low-privileged local access (PR:L, AV:L) to a Windows system where the Work Folders feature/component is present and in use, and to reliably win the use-after-free race/timing window (AC:H). Limiting factors that reduce realistic risk: no remote vector (must have a local foothold first), existing authentication required, and high attack complexity meaning exploitation is not trivially reliable. No user interaction is needed (UI:N). The flaw does not provide initial access - it is a post-compromise privilege-escalation step against hosts running the affected Work Folders code paths.

This is a genuine but not top-tier priority. The CVSS 3.1 vector (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0 HIGH) describes a local privilege-escalation requiring an attacker to already hold low-level privileges (PR:L) on the host and to win a difficult-to-engineer race/memory-corruption condition (AC:H), yielding total compromise of confidentiality, integrity and availability. The CISA SSVC framework corroborates a lower operational urgency: Exploitation status is 'none' (no observed exploitation), Automatable is 'no' (consistent with AC:H and the need for prior local access), though Technical Impact is 'total' (consistent with C:H/I:H/A:H). There is no CISA KEV listing and no POC referenced in the input, so exploitation status is 'no public exploit identified at time of analysis'. No EPSS score was provided, so probabilistic exploitation likelihood cannot be factored in - STATE EXPLICITLY: EPSS data is MISSING. The signals are internally consistent rather than conflicting: a local, high-complexity, authenticated UAF with no evidence of exploitation. The realistic verdict is a reliable second-stage escalation primitive for an attacker who already has a foothold, not a wormable or remotely-reachable emergency. Given the ubiquity of Windows, patch prioritization is still warranted, but it sits below any network-reachable or actively-exploited flaw.

An attacker who has already gained low-privileged code execution on a Windows host (e.g., via phishing or a prior foothold) triggers a use-after-free in the Work Folders component by carefully timing operations to reuse freed memory. By grooming the heap and winning the race condition (high complexity), they corrupt kernel/service state to execute code at elevated privilege. No public exploit code is identified at time of analysis, and the high attack complexity makes reliable weaponization non-trivial.