Windows DiagTrack EUVD-2026-99327

Exploitation requires the attacker to already have authenticated local access with low privileges (PR:L) on an affected host running the Windows Connected User Experiences and Telemetry (DiagTrack) service, which is enabled by default on Windows 11 (versions 23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2025. No user interaction is needed (UI:N), but the high attack complexity (AC:H) means the attacker must reliably win a race condition to reuse the freed memory object, which limits deterministic exploitation. There is no remote vector (AV:L) - the attacker must first obtain a foothold on the machine, so this is a post-compromise privilege-escalation primitive rather than an initial-access flaw.

This is a genuine but moderate-priority local privilege escalation. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0 HIGH) describes a locally-exploitable use-after-free (CWE-416) that an already-authenticated low-privileged user (PR:L) can leverage to gain full confidentiality, integrity and availability impact on the host - consistent with SSVC Technical Impact 'total'. Multiple signals converge to temper the raw severity: AC:H reflects the race-condition / timing-dependent nature typical of use-after-free bugs, meaning exploitation is not deterministic; SSVC records Exploitation 'none' and Automatable 'no'; and there is no CISA KEV listing and no EPSS score supplied. No public exploit code is identified at time of analysis. The signals are mutually consistent rather than conflicting - all point to a real-but-hard-to-exploit local EoP, not a mass-exploitation threat. The limiting factors (local access, existing low privilege, high attack complexity) mean this is a patch-in-normal-cadence issue for most environments, with higher priority on multi-user or shared hosts where untrusted local users exist. Note: no EPSS probability was provided in the input, so likelihood-of-exploitation cannot be quantified numerically.

A low-privileged local user already present on a Windows 11 or Windows Server 2025 host runs code that races the Connected User Experiences and Telemetry service to trigger a use-after-free, reclaiming the freed object with attacker-controlled data to execute code at higher privilege. Because attack complexity is high (AC:H), the attacker likely needs multiple attempts to win the timing window. No public proof-of-concept is identified at time of analysis.