Windows Sensor Data Service CVE-2026-50367

Exploitation requires the attacker to already possess authenticated low-privileged local access to the target (CVSS PR:L, AV:L) and the ability to execute code that interacts with the Windows Sensor Data Service on an affected Windows 10/11 or Windows Server 2019-2025 build; no user interaction is needed (UI:N) and attack complexity is low (AC:L). The key limiting factors are that this is purely local - it cannot be triggered remotely over a network and provides no initial access - and it presupposes the attacker can run arbitrary code as a standard user. Systems where the Sensor Data Service is disabled or where untrusted local code execution is prevented are correspondingly harder to exploit.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) describes a realistic local elevation-of-privilege primitive: low attack complexity, only low existing privileges required, no user interaction, and full C/I/A impact within an unchanged scope. This is a classic second-stage escalation useful after initial foothold. No EPSS score was provided and the CVE is not in CISA KEV, so there is no evidence of active exploitation or high exploitation probability; likewise no POC was supplied, so this should be treated as a patch-on-cycle rather than emergency issue absent further signals. One inconsistency to note: the Tags field labels this 'Information Disclosure', but both the description ('elevate privileges') and the CVSS impact (I:H/A:H, not confidentiality-only) indicate a privilege-escalation/EoP class flaw - the tag appears mislabeled and should be verified against the Microsoft advisory. Because it requires local authenticated access, real-world risk is meaningful but bounded compared to a remote unauthenticated flaw.

An attacker who has already obtained low-privileged local access - for example a standard domain user on a shared terminal server or a compromised limited service account - runs a crafted process that interacts with the Windows Sensor Data Service to trigger the out-of-bounds index condition. By exploiting the range error, the attacker manipulates the privileged service to execute code or corrupt state in a higher-privilege context, escalating to SYSTEM. No user interaction is required and attack complexity is low; no public exploit code is currently identified.