EUVD-2026-72988
GHSA-9qj6-qqgj-76rr
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Local-only access, race-condition trigger requires AC:H, standard user authentication required per PR:L, full SYSTEM-level C/I/A impact if exploited successfully.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
4DescriptionCVE.org
Use after free in Windows Connected User Experiences and Telemetry allows an authorized attacker to elevate privileges locally.
AnalysisAI
Local privilege escalation in the Windows Connected User Experiences and Telemetry service (DiagTrack/utcsvc) exposes a use-after-free memory condition allowing an authenticated local attacker to achieve full SYSTEM-level control. The vulnerability carries CVSS 7.0 with AC:H, indicating a race-condition or timing-dependent trigger that elevates exploitation difficulty but does not preclude reliable use in post-breach scenarios. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated local session on the target system with at minimum standard user privileges, consistent with PR:L in the CVSS vector. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.0 score with AV:L/AC:H/PR:L reflects a local, authenticated, high-complexity exploit path - practically relevant as a post-exploitation privilege escalation step after an attacker obtains initial foothold via a separate vector such as phishing or credential theft. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply Microsoft's cumulative security update containing the DiagTrack fix for each affected product line. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Windows client and server systems in inventory and prioritize servers and privileged-user workstations; begin procurement and testing of Microsoft-released security patches. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-416 – Use After Free
View allSame technique Use After Free
View allShare
External POC / Exploit Code
Leaving vuln.today