Windows Client-Side Caching EUVD-2026-99956

Exploitation requires the attacker to already possess local low-privileged access to the host (PR:L) and the ability to interact with the Windows Client-Side Caching (CSC) service, the component underpinning Offline Files; the CSC service (cscservice/csc.sys) is present and running by default on affected Windows client and server editions. No user interaction is required (UI:N) and attack complexity is low (AC:L). The primary limiting factor is the local attack vector - there is no remote or network-based path; an attacker must first obtain code execution as an authenticated low-privileged user. This makes it a post-compromise privilege-escalation primitive rather than an initial-access vulnerability.

This is a locally-exploitable elevation-of-privilege flaw with a vendor-assigned CVSS of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). All signals point to a genuine but not emergency priority. The attack vector is local (AV:L) and requires existing low-level privileges (PR:L), so an attacker must already be able to run code as a standard authenticated user on the host - this is a privilege-escalation building block, not a remote entry point. No EPSS score was provided in the input, so exploitation probability cannot be quantified. The vulnerability is NOT listed in CISA KEV and no public exploit code was referenced, so it maps to 'no public exploit identified at time of analysis.' There is no SSVC decision data in the input. The signals are internally consistent (heap overflow + CWE-122 + local EoP align with the CVSS vector), so no contradictions are present. The main driver of real-world risk is the extremely broad affected footprint across virtually all supported Windows and Windows Server versions; the mitigating factor is that an attacker must already have a foothold. Prioritize for standard patch cycles and prioritize higher on multi-user or shared hosts where local untrusted users exist.

An attacker who already has low-privileged code execution on a Windows host (e.g., via a standard user account or a compromised low-privilege service) submits crafted input to the Client-Side Caching (CSC) service to trigger a heap-based buffer overflow, corrupting memory to gain SYSTEM-level privileges. Exploitation is local with low attack complexity and no user interaction, but no public proof-of-concept exploit was identified at the time of analysis.