# CVE-2026-58637 — Windows Client-Side Caching `cscsvc.dll` Unsynchronized Offline Files Enumerator (`CEnumOfflineFilesData_Flat`) → Use-After-Free

---

## Summary

| | |
|---|---|
| **Product** | Windows — `cscsvc.dll` (Client-Side Caching / Offline Files service, runs as SYSTEM) |
| **CVE ID** | CVE-2026-58637 |
| **Impact** | Elevation of Privilege (to SYSTEM) |
| **MSRC severity** | Important |
| **CVSS** | 7.0 / 6.1 — `CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C` |
| **CWE** | CWE-416: Use After Free |
| **Delivery** | Local — concurrent operations on a CSC Offline Files enumerator (race) |
| **KB / Fixed build** | KB5101650 — `cscsvc.dll` 10.0.26100.8875 (Win11 24H2 x64) |
| **Patch Date** | July 14, 2026 (2026-Jul) |
| **Pre-patch binary** | `cscsvc.dll` 10.0.26100.8737 — SHA256 `5664015e4d7af6d446f93063cefb8e2c6a4ebedd1284a31e2756b9b00607cb2b` |
| **Post-patch binary** | `cscsvc.dll` 10.0.26100.8875 — SHA256 `8109e9968b851fb6a64812cecc39fbf6d2e9b125bfb90304a25a508c0b03f11d` |
| **Feature flag** | `Feature_892568891` — **the fix is CFR-gated** |
| **Exploitability** | Exploitation Less Likely; not publicly disclosed; not exploited (per MSRC) |

---

## Product Description

`cscsvc.dll` is the **Client-Side Caching (CSC) / Offline Files** service, which runs
as SYSTEM and lets clients enumerate cached offline-file data. The enumerator
`CEnumOfflineFilesData_Flat` implements the flat enumeration interface — `Next`,
`Skip`, `Reset`, and `Clone` — advancing an internal cursor over the enumerator's
backing item data (built from an item-filter block copied into the object at
construction).

---

## Vulnerability Summary

Pre-patch, the `CEnumOfflineFilesData_Flat` methods performed **no serialization**
of access to the enumerator's cursor and backing data. Two operations issued
concurrently against the same enumerator object (e.g. `Next` racing `Clone`/`Reset`)
could therefore run at once, so one operation could free or advance the cursor /
backing item data while another was still dereferencing it — a use-after-free
(CWE-416). Because `cscsvc` runs as **SYSTEM** and the enumerator is reachable by a
local (domain) user through the Offline Files interface, and exploitation requires
winning the race (`AC:H`), the UAF is a local elevation-of-privilege primitive that
yields SYSTEM (per the MSRC FAQ, a domain user could elevate to SYSTEM integrity).

---

## Prerequisites and Constraints

- Local, low-privileged / domain user (`PR:L`, `AV:L`); `AC:H` — must win a race
  between concurrent enumerator operations.
- Obtain a CSC Offline Files enumerator and drive `Next`/`Clone`/`Skip`/`Reset`
  concurrently on the same object.
- Result: the enumerator's backing allocation is freed/advanced while still in use.

---

## Vulnerability Details

### Root Cause

`CEnumOfflineFilesData_Flat`'s cursor and backing item data were shared across its
`Next`/`Clone`/`Skip`/`Reset` methods without any lock, so concurrent calls could
free/advance the data another call was still using.

### The patch (confirmed — diff, .8737 → .8875)

Gated behind `Feature_892568891`, `CEnumOfflineFilesData_Flat` gains a
**`CRITICAL_SECTION`** member — the object grows by ~`0x30` bytes and its existing
members shift from `+0x278` to `+0x2a8` — and the enumerator methods now take that
lock around the cursor iteration:

```c
// CEnumOfflineFilesData_Flat::Next (10.0.26100.8875) — PATCHED (from our diff)
if (Feature_892568891__private_IsEnabled())
    EnterCriticalSection((LPCRITICAL_SECTION)(this + 0x278));
lVar2 = _Next(this, ...);                       // cursor advance now serialized
if (Feature_892568891__private_IsEnabled())
    LeaveCriticalSection((LPCRITICAL_SECTION)(this + 0x278));
```

`Clone` is likewise guarded (and now reads the path via `CPath::_GetConstBuffer`
instead of `CCscScope::Path`, avoiding a transient/dangling buffer); the constructor
initializes and the destructor deletes the new critical section; `Skip`/`Reset`
participate in the serialized access. With all enumerator operations serialized, the
backing data can no longer be freed or advanced while another operation is using it,
closing the use-after-free.

### Patch Completeness Assessment

**CFR-gated behind `Feature_892568891`.** The critical-section serialization runs
only when the flag is enabled; the original unsynchronized enumerator still ships
when disabled. Verify `Feature_892568891` is enabled to confirm the fix is live.

---

## Detection Guidance

**Behavioural.** Multiple concurrent operations on the same CSC Offline Files
enumerator from one client; use-after-free / heap-corruption crashes in
`cscsvc!CEnumOfflineFilesData_Flat::Next` / `Clone` within the SYSTEM CSC service on
unpatched/flag-disabled builds.

**Config.** The fix is CFR-gated — confirm `Feature_892568891` is enabled.

---

## References

- MSRC advisory — CVE-2026-58637 (Windows Client-Side Caching Elevation of Privilege), released 2026-07-14, KB5101650.
- Full binary diff: `/data/patch_diffs/cscsvc_dll-cve-2026-58637-ghidriff.md`