Executive brief
A security vulnerability exists in the Windows component responsible for managing user experiences and diagnostic data (telemetry). An attacker who already has basic access to a computer could exploit this flaw to gain full administrative control over the system. This could allow them to view sensitive data, install malicious software, or disrupt business operations.
Technical details
A type confusion vulnerability (CWE-843) exists in the Windows Connected User Experiences and Telemetry service. The flaw occurs when the component accesses a resource using an incompatible type, which can be manipulated by a local attacker with low privileges. By successfully exploiting this vulnerability, an attacker can execute code with elevated system privileges. The attack requires local access but no user interaction. Microsoft has released security updates to address this issue across affected Windows 10, 11, and Server versions.
Affected products
- Microsoft Windows 10 1607, 1809, 21H2, 22H2
- Microsoft Windows 11 24H2, 25H2, 26H1
- Microsoft Windows Server 2016 All versions
Timeline
- 2026-07-14: disclosed
- 2026-07-14: advisory