Executive brief
A security vulnerability exists in several Microsoft Surface hardware devices, including Surface Pro, Laptop, and Hub models. An attacker who already has basic access to the device could exploit this flaw to gain higher-level administrative privileges. This could allow them to take full control of the system, access sensitive data, or bypass security restrictions.
Technical details
A local privilege escalation vulnerability exists in Microsoft Surface devices due to insufficient granularity of access control (CWE-1220). An attacker with low-privileged local access can exploit this flaw to gain elevated system permissions. The vulnerability affects a wide range of Surface hardware, including the Surface Pro 8, Surface Laptop 4, and Surface Hub. The attack vector is local, requiring the attacker to have already established a presence on the target machine. Microsoft has released security updates to address this issue via the MSRC update guide.
Affected products
- Microsoft Surface Go All versions
- Microsoft Surface Hub All versions
- Microsoft Surface Laptop Go All versions
- Microsoft Surface Laptop Go 3 All versions
- Microsoft Surface Pro All versions
- Microsoft Surface Pro 8 All versions
- Microsoft Surface Laptop 4 with AMD Processor All versions
- Microsoft Surface Laptop 4 with Intel Processor All versions
- Microsoft Surface Windows Dev Kit All versions
Timeline
- 2026-07-14: disclosed
- 2026-07-14: advisory