EUVD-2026-44306
GHSA-4rh4-3695-hmxr
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Local authenticated user (AV:L/PR:L) exploiting a use-after-free race (AC:H) with no UI, yielding full SYSTEM-level compromise (C:H/I:H/A:H) within an unchanged scope.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Use after free in Windows Sensor Data Service allows an authorized attacker to elevate privileges locally.
AnalysisAI
Local privilege escalation in Microsoft Windows Sensor Data Service arises from a use-after-free (CWE-416) memory corruption flaw that an already-authenticated attacker can trigger to run code at higher privilege. It affects a broad range of client and server builds (Windows 10 1607 through Windows 11 26H1, and Windows Server 2016 through 2025). Reported by Microsoft with a patch available; no public exploit identified at time of analysis, and the CVSS:3.1 score is 7.0 (High).
Technical ContextAI
The Windows Sensor Data Service (SensorDataService) is a system component that manages data from device sensors (accelerometer, GPS, ambient light, orientation, etc.) and exposes it to applications through the Windows sensor platform. The root cause is CWE-416 Use After Free: the service references a memory object after it has been freed, and if an attacker can reallocate that freed memory with attacker-controlled content and then force the dangling reference to be used, the resulting corruption can redirect execution or manipulate privileged state. The CPE data confirms this is a Microsoft-native OS component present across Windows 10, Windows 11, and Windows Server editions rather than a third-party library, so the affected code ships as part of the base operating system.
RemediationAI
Apply the Microsoft security update for CVE-2026-58619 (Patch available per vendor advisory) via Windows Update or WSUS/SCCM/Intune; identify the exact KB and fixed build for each affected SKU from the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58619, as specific fix version numbers are not provided in the input data and should not be invented. There is no vendor-documented workaround for this memory-corruption flaw, so patching is the primary control. As interim compensating measures on unpatched hosts, restrict local and interactive logon rights to reduce the pool of 'authorized' users who could attempt exploitation, and monitor for anomalous behavior of the Sensor Data Service; note that the service is a default OS component and disabling or restricting sensor functionality may break legitimate device features (screen auto-rotation, location, adaptive brightness), so treat that as a last resort rather than a standing control.
More in Windows Server 2016
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Active Directory Domain Services Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.5), this vulnerabilit
Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today