Windows Sensor Data Service CVE-2026-58619

Exploitation requires the attacker to already be a locally authenticated, low-privileged user on the target host (CVSS PR:L, AV:L) with the ability to execute code that interacts with the Sensor Data Service; it cannot be performed remotely or unauthenticated. The principal limiting factor is AC:H, indicating exploitation depends on winning a race condition or satisfying timing/heap-grooming conditions inherent to the use-after-free, which makes reliable exploitation non-trivial. No user interaction is needed (UI:N), and the affected service is present by default across the listed Windows client and server builds, so no special non-default configuration is required beyond having local access and the service running.

The CVSS:3.1 vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H yields 7.0 (High) and is internally consistent for a local elevation-of-privilege bug: exploitation requires local access (AV:L), some existing privileges (PR:L, an authorized/authenticated user), no user interaction, and a high-complexity condition (AC:H) that typically reflects the race window inherent to use-after-free exploitation. Impact is high across confidentiality, integrity, and availability because successful exploitation grants elevated (potentially SYSTEM-level) execution. No EPSS score, KEV listing, or POC was provided, so real-world exploitation pressure appears low-to-moderate today; the AC:H metric and requirement for prior local access further reduce mass-exploitation likelihood. This is a standard 'patch on the normal cycle' EoP rather than an emergency, but it remains valuable to attackers as a post-compromise privilege escalation primitive and should not be deprioritized on multi-user or server hosts. No conflicting signals were identified in the provided data; the absence of EPSS/KEV/POC is a data gap, not a confirmation of low risk.

An attacker who already has a low-privileged foothold on a Windows host - for example, a standard user account obtained via phishing or a compromised service - runs a crafted local program that repeatedly interacts with the Sensor Data Service to trigger the use-after-free and win the timing race (AC:H). By grooming the heap to reoccupy the freed object, the attacker corrupts memory to execute code in the service's privileged context and elevate to SYSTEM. No public exploit was identified at time of analysis, so this remains a plausible but not yet demonstrated post-compromise escalation path.