Windows Storage EUVD-2026-99840

Requires the attacker to already have local, authenticated access to the Windows host with at least low-level privileges (PR:L) - this is not remotely reachable (AV:L). Exploitation further depends on reliably winning a race condition in the Windows Storage component's improper synchronization of a shared resource (CWE-362); the HIGH attack complexity (AC:H) reflects that the attacker must repeatedly trigger concurrent operations and hit a narrow, non-deterministic timing window, which limits reliability and makes the attack non-automatable per CISA SSVC. No special non-default configuration is named in the description; the limiting factors are the pre-existing local foothold and the timing-dependent nature of the race.

This is a locally-exploitable privilege-escalation flaw (CVSS:3.1 base 7.0) in Windows Storage, requiring local access (AV:L), low existing privileges (PR:L), no user interaction (UI:N), but HIGH attack complexity (AC:H) because the attacker must reliably win a race-condition timing window (CWE-362). Technical impact is total (full C/I/A compromise of the host), which aligns with the CVSS C:H/I:H/A:H. However, the exploitation signals point to LOW real-world urgency: there is no EPSS score provided, CISA SSVC explicitly rates Exploitation=none and Automatable=no, there is no CISA KEV listing, and no public POC is identified. The AC:H requirement and non-automatable nature mean reliable weaponization is non-trivial. Net: a genuinely serious flaw if chained by an attacker who already has a foothold, but NOT a drop-everything emergency - prioritize it within normal Patch Tuesday cadence rather than as an actively-exploited emergency. Note one metadata inconsistency: the input Tags include 'Information Disclosure,' whereas the description characterizes this strictly as local privilege elevation - treat the disclosure framing with caution and rely on the EoP description plus the full C:H/I:H/A:H vector.

A low-privileged user who already has local code-execution on a Windows host runs a crafted program that repeatedly triggers the Windows Storage operation while racing a concurrent thread to exploit the improper synchronization window. On a successful race win, the attacker corrupts shared state and escalates from a standard user to SYSTEM-level privileges. No public exploit code is identified at time of analysis, and the high attack complexity (AC:H) means the attacker may need many attempts to win the race reliably.