Executive brief
A security feature bypass has been identified in Windows Remote Assistance, a tool used by support staff to view or control a user's computer remotely. An attacker who successfully exploits this could bypass built-in security protections, potentially leading to unauthorized access to sensitive information. To be successful, the attacker would need to convince a user to perform a specific action on the local system.
Technical details
A protection mechanism failure (CWE-693) exists in Windows Remote Assistance. The vulnerability allows a local attacker to bypass security features, provided they can induce a user to interact with a malicious application or file (User Interaction required). According to the CVSS vector, the attack vector is local, complexity is low, and the primary impact is on confidentiality. Microsoft has released security updates for various versions of Windows 10, Windows 11, and Windows Server to address this issue.
Affected products
- Microsoft Windows 10 Version 1607 10.0.14393.0 to 10.0.14393.8783
- Microsoft Windows 10 Version 1809 10.0.17763.0 to 10.0.17763.8276
- Microsoft Windows 10 Version 21H2 10.0.19044.0 to 10.0.19044.6809
- Microsoft Windows 10 Version 22H2 10.0.19045.0 to 10.0.19045.6809
- Microsoft Windows 11 Version 22H3 10.0.22631.0 to 10.0.22631.6491
- Microsoft Windows 11 Version 23H2 10.0.22631.0 to 10.0.22631.6491
- Microsoft Windows 11 Version 24H2 10.0.26100.0 to 10.0.26100.7623
- Microsoft Windows 11 Version 25H2 10.0.26200.0 to 10.0.26200.7623
- Microsoft Windows Server 2012 6.2.9200.0 to 6.2.9200.25868
Timeline
- 2026-01-13: advisory: Initial disclosure by Microsoft