Windows DiagTrack EUVD-2026-72988

Exploitation requires an authenticated local session on the target system with at minimum standard user privileges, consistent with PR:L in the CVSS vector. The DiagTrack service must be running - it is enabled by default on most Windows installations including consumer SKUs and many server configurations. High attack complexity (AC:H) indicates a race condition or specific timing requirement that must be met, reducing reliability and ruling out single-shot automated exploitation. No network access is needed; the entire attack surface is local. What limits exploitation: the attacker must already possess local code execution under a low-privilege account, the race-condition requirement demands precision and likely multiple attempts, and no public exploit currently exists. Systems where DiagTrack is explicitly disabled via policy or where local interactive login is restricted to administrators are not exposed.

The CVSS 7.0 score with AV:L/AC:H/PR:L reflects a local, authenticated, high-complexity exploit path - practically relevant as a post-exploitation privilege escalation step after an attacker obtains initial foothold via a separate vector such as phishing or credential theft. The AC:H metric substantially reduces the risk of automated, mass exploitation: successful triggering of the race condition requires precise timing or specific system state, meaning repeated attempts are typically needed. CISA KEV listing is absent and no public exploit code has been identified, making widespread opportunistic exploitation unlikely at this time. EPSS data was not provided in the input and exploitation probability cannot be quantified. Despite C:H/I:H/A:H impact metrics, practical threat is concentrated in targeted intrusions where an adversary already holds a low-privilege local session. The broad affected surface - encompassing consumer and server Windows SKUs back to Server 2016 - means the patch surface is large, and organizations operating multi-user, shared, or VDI environments face the highest realistic exposure.

An attacker who has obtained a standard user shell on a Windows workstation - for example via a phishing payload or lateral movement with stolen credentials - identifies the DiagTrack SYSTEM service as a local privilege escalation target. The attacker races a crafted interaction sequence against the service's memory management to win the use-after-free condition, achieves code execution in the SYSTEM context, and installs persistence or dumps credentials from LSASS. No public exploit code is known at time of analysis, and the AC:H race-condition nature means multiple attempts are typically required.