Windows CSC Service EUVD-2026-99682

Exploitation targets the Windows Client-Side Caching (CSC) / Offline Files service, which caches content from SMB network shares. The attacker must get a victim to interact (UI:R) - typically by connecting to or accessing an attacker-controlled network share/resource so the CSC service parses a crafted response and overflows a heap buffer. Limiting factors: required user interaction (no fully automatic/wormable path, consistent with SSVC Automatable:no), and vendor patches are already available across all affected builds; unpatched, default Windows installations with Offline Files/CSC in use are exposed over the network.

This is a serious but not emergency-grade issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes network-reachable, low-complexity, unauthenticated exploitation with full confidentiality/integrity/availability impact, gated only by required user interaction. CISA's SSVC framework tempers this: Exploitation is rated 'none' (no observed attacks), Automatable is 'no' (UI:R breaks reliable mass-automation), while Technical Impact is 'total' - consistent with the heap overflow yielding full system control. There is no CISA KEV listing and no public POC in the provided data, so exploitation status is 'no public exploit identified at time of analysis.' Note a real labeling tension defenders should be aware of: Microsoft's description frames this as privilege elevation ('elevate privileges over a network'), yet the CVSS vector carries PR:N (unauthenticated) and AV:N - more characteristic of remote code execution than classic local EoP. This is Microsoft's standard characterization for CSC EoP flaws triggered via a malicious network resource, but verify the exact exploitation path with MSRC before assuming no authentication foothold is needed. Net: a patch-promptly priority given ubiquitous Windows exposure and total impact, but the UI:R requirement and 'Exploitation: none' SSVC signal argue against drop-everything urgency absent new exploitation evidence.

An attacker lures a user into connecting to an attacker-controlled network share or offline-files resource; the Client-Side Caching service processes a maliciously crafted response and overflows a heap buffer, letting the attacker run code in the service's privileged context. No public exploit code is identified at time of analysis, and the single required click/connection (UI:R) is the main hurdle.