EUVD-2026-22386
GHSA-9jjg-8mxf-5rr7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as local user
-
ExploitCraft malicious input to Sensor Data Service
-
ExecutionDereference untrusted pointer
-
ImpactEscalate privileges to SYSTEM
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Untrusted pointer prevention
|
| Exploitation Conditions | Attacker must have local user account credentials on Windows system with Sensor Data Service running. Requires ability to interact with vulnerable service endpoints as authenticated user. |
| Impact | This vulnerability presents moderate real-world risk despite its CVSS 7.8 HIGH rating. The attack vector is local (AV:L) requiring prior system access, and authenticated credentials (PR:L) are mandatory, significantly limiting the attack surface compared to remote vulnerabilities. Attack complexity is low (AC:L) with no user interaction (UI:N), meaning any local user can reliably exploit this once they have a foothold. EPSS scoring is not provided, but the lack of CISA KEV listing and absence of public exploit code suggests no confirmed active exploitation in enterprise environments. From an SSVC perspective: exploitation status is POC-likely given the low complexity but unconfirmed publicly; automatable is NO due to local-only vector; technical impact is TOTAL (full system compromise). This positions the vulnerability as a second-stage escalation tool rather than an initial access vector. Priority should be HIGH for multi-user systems, terminal servers, or environments where untrusted local users exist, but MEDIUM for single-user workstations with strong access controls. The widespread platform coverage (14 affected version ranges across Windows client and server) and availability of patches make remediation straightforward, elevating this to patch-immediately status for hardened environments despite the lack of active exploitation evidence. |
| Exploit ScenarioDerived | An attacker who has gained initial access to a Windows system through phishing, stolen credentials, or another vulnerability operates with a standard user account. They execute malicious code that interacts with the Windows Sensor Data Service API, submitting specially crafted sensor data structures containing invalid pointer addresses. The service, running with SYSTEM privileges, dereferences these untrusted |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 14, 2026
Local privilege escalation in Windows Sensor Data Service affects all supported Windows 10, Windows 11, and Windows Server versions through untrusted pointer dereference (CWE-822). Authenticated local attackers with low-privilege accounts can exploit this vulnerability with low complexity to gain SYSTEM-level privileges, achieving full compromise of confidentiality, integrity, and availability. Vendor-released patches are available across all affected product lines. No public exploit identified
Earlier versions of this analysis (1)
Local privilege escalation in Windows Sensor Data Service affects all supported Windows 10, Windows 11, and Windows Server versions through untrusted pointer dereference (CWE-822). Authenticated local attackers with low-privilege accounts can exploit this vulnerability with low complexity to gain SYSTEM-level privileges, achieving full compromise of confidentiality, integrity, and availability. Vendor-released patches are available across all affected product lines. No public exploit identified at time of analysis, though the low attack complexity (AC:L) and low privilege requirement (PR:L) make this an attractive post-compromise escalation vector.
RemediationAI
Apply the vendor-released security updates immediately through Windows Update or WSUS. Patched versions are Windows 10 1809 build 10.0.17763.8644 or later, Windows 10 21H2 build 10.0.19044.7184 or later, Windows 10 22H2 build 10.0.19045.7184 or later, Windows 11 22H3/23H2 build 10.0.22631.6936 or later, Windows 11 24H2 build 10.0.26100.32690 or later, Windows 11 25H2 build 10.0.26200.8246 or later, Windows 11 26H1 build 10.0.28000.1836 or later, Windows Server 2019 build 10.0.17763.8644 or later, Windows Server 2022 build 10.0.20348.5020 or later, Windows Server 2022 23H2 build 10.0.25398.2274 or later, and Windows Server 2025 build 10.0.26100.32690 or later. Microsoft's official update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26161 contains downloadable patches and deployment instructions. No workarounds are documented; patching is the only effective mitigation. Organizations unable to patch immediately should review local user permissions and restrict interactive logon rights to trusted accounts only, though this provides limited protection given the low privilege requirement.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 25 packages in microsoft, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability stems from CWE-822 (Untrusted Pointer Dereference), a memory corruption class where the Windows Sensor Data Service improperly validates pointer values before dereferencing them. The Sensor Data Service is a Windows component that manages sensor hardware interactions (accelerometers, GPS, ambient light sensors, etc.) and runs with elevated privileges. When processing sensor data or API calls, the service fails to adequately validate pointer addresses supplied by lower-privileged callers. An attacker can supply a crafted pointer that, when dereferenced by the privileged service, redirects execution flow or corrupts critical memory structures. Because the service operates in the SYSTEM security context, successful exploitation allows arbitrary code execution with the highest Windows privilege level. The vulnerability affects the sensor framework implementation spanning Windows 10 version 1809 through Windows 11 version 26H1 and all contemporary Windows Server editions (2019, 2022, 2025), indicating a longstanding architectural weakness in the sensor data handling subsystem rather than a recently introduced bug.
Know when Windows Server 2019 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Untrusted pointer dereference in Windows Sensor Data Service allows an authorized attacker to elevate privileges locally.
Executive ViewAI
CVE-2026-26161 is a local privilege escalation vulnerability in Windows Sensor Data Service affecting all supported Windows 10, Windows 11, and Windows Server versions that allows low-privileged authenticated users to gain SYSTEM-level access with minimal effort. This post-compromise escalation vector poses significant risk to organizations where standard user accounts are frequently compromised, as attackers can leverage this to achieve complete system control and lateral movement within the enterprise.
Apply vendor patch. Until patches are deployed, implement application whitelisting policies to restrict execution of sensor service processes, enable and monitor Windows Event Logging for privilege escalation events (Event ID 4688 with parent process tracking), enforce principle of least privilege on local user accounts, and segregate high-value systems using network segmentation to limit lateral movement post-compromise.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
More in Windows Server 2019
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
Windows Win32k contains an out-of-bounds write vulnerability enabling local privilege escalation to SYSTEM, exploited by
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
Internet Shortcut Files Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.1), this vulnerability is rem
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Active Directory Domain Services Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.5), this vulnerabilit
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Exploit-DB