Trace Data Helper CVE-2026-56198

Requires an authenticated local user account with at least standard (low) privileges on a vulnerable Windows 11 or Windows Server 2025 build - consistent with CVSS PR:L. The attacker must be able to execute code locally (AV:L); remote exploitation is not possible without a prior foothold obtained through an unrelated vector such as RDP, SSH, or a chained remote vulnerability. No non-default configuration is required - tdh.dll is loaded by default on all affected OS versions and is invokable from any user context through the ETW consumer API. No user interaction (UI:N) beyond the attacker's own process execution is needed. Exploitation is constrained to systems running the specific unpatched build ranges; fully patched systems are not affected.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.8) is internally consistent and appropriately calibrated: local-only attack surface, low-privilege requirement, and no user interaction, producing a reliable but not remotely-triggerable escalation path. The high impact triad (C:H/I:H/A:H) is credible for a SYSTEM-level LPE. EPSS data is not present in the provided intelligence, and there is no CISA KEV listing, so real-world exploitation probability cannot be quantified beyond base-rate inference. Absent a public POC, immediate exploitation risk is moderate - though once such a bug is reverse-engineered from the patch diff, AC:L means rapid weaponization is plausible. Because the affected component is a core OS library present on any Windows 11 or Server 2025 system, even a mid-sized municipal IT team in walbrzych managing a mixed fleet of these OS versions should treat this as an urgent patch-cycle item rather than deprioritizing it on grounds of local-only access. The primary limiting factor is the need for an authenticated local session, which post-initial-access LPE bugs typically satisfy in enterprise breach scenarios.

An attacker who has obtained a low-privileged local Windows session - via phishing, compromised service account, or lateral movement - calls TDH API functions with crafted inputs to trigger the out-of-bounds read, leaking kernel-space addresses that defeat ASLR. The leaked pointer data is then used to construct a subsequent write primitive, redirecting execution flow and elevating to NT AUTHORITY\SYSTEM. No public proof-of-concept is available at time of analysis, but the AC:L rating implies the technique would be straightforward to implement once the vulnerable code path is identified from patch diffing.