EUVD-2026-56616
GHSA-3vj7-ww59-w49r
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local vector confirmed by description; PR:L as standard user access suffices; no user interaction needed; full CIA impact on the local system with no scope change.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Heap-based buffer overflow in Windows Sensor Data Service allows an authorized attacker to elevate privileges locally.
AnalysisAI
Heap-based buffer overflow in the Windows Sensor Data Service enables a locally authenticated, low-privileged attacker to fully compromise a target Windows system by escalating to SYSTEM-level privileges. Affecting Windows 10 (21H2, 22H2), Windows 11 (23H2 through 26H1), Windows Server 2022, and Windows Server 2025 across dozens of specific build ranges, exploitation requires no user interaction and low complexity once local access is established. No public exploit code or CISA KEV listing has been identified at time of analysis, but SSVC classifies technical impact as total; Microsoft has released patches across all affected product lines.
Technical ContextAI
CWE-122 (Heap-based Buffer Overflow) describes a condition where a program writes data beyond the bounds of a heap-allocated memory region, potentially corrupting adjacent heap structures such as function pointers, vtables, or allocator metadata. The Windows Sensor Data Service is a privileged system service responsible for aggregating telemetry from hardware sensors - including ambient light sensors, accelerometers, and gyroscopes - on Windows devices. Because the service runs under a high-privilege security context, a successful heap overflow can redirect execution flow to attacker-controlled code operating at SYSTEM level. The CVSS vector AV:L/AC:L/PR:L/UI:N/S:U is consistent with a classic local privilege escalation pattern: the attacker interacts with a locally accessible service interface without requiring elevated credentials, user interaction, or complex preconditions. Affected product lines span Windows 10 versions 21H2 and 22H2, Windows 11 versions 23H2, 24H2, 25H2, and 26H1, Windows Server 2022, and Windows Server 2025 (including Server Core), as enumerated in ENISA EUVD-2026-56616.
RemediationAI
The primary remediation is to apply Microsoft's security update for CVE-2026-61355 via Windows Update, Windows Server Update Services (WSUS), or the Microsoft Update Catalog. Target fixed build versions by product: Windows 10 21H2 → 10.0.19044.7663 or later; Windows 10 22H2 → 10.0.19045.7663 or later; Windows 11 23H2 → 10.0.22631.7517 or later; Windows 11 24H2 and 25H2 → 10.0.26100.9168 or later; Windows 11 26H1 → 10.0.28000.2704 or later; Windows Server 2022 → 10.0.20348.5499 or later; Windows Server 2025 (including Server Core) → 10.0.26100.33296 or later. Where patching cannot be applied immediately, consider disabling the Windows Sensor Data Service on systems where sensor functionality (ambient light, accelerometer, orientation) is not required - this can be accomplished via 'sc config SensorDataService start= disabled' and stopping the service; note this will break adaptive brightness and device orientation features on laptops and tablets. Additionally, restrict interactive logon rights to high-value systems using Group Policy ('Deny log on locally') to reduce the pool of accounts that can attempt local exploitation. Full vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-61355.
More in Windows 10 21h2
View all<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
Internet Shortcut Files Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.1), this vulnerability is rem
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Windows Kernel Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack co
Active Directory Domain Services contains an elevation of privilege vulnerability that allows authenticated domain users
Windows Kernel-Mode Driver Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is l
Windows MSHTML Platform Spoofing Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitab
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today