Executive brief
Windows Connected User Experiences and Telemetry is a system service that collects and transmits diagnostic data. A race condition in its shared resource handling allows an authorized local attacker to escalate privileges to system level, potentially compromising the entire Windows machine.
Technical details
A race condition exists in Windows Connected User Experiences and Telemetry due to improper synchronization of shared resources. An authorized attacker with local access can exploit this timing vulnerability to execute code with elevated privileges. The vulnerability requires local authentication and physical/local access to the system. Successful exploitation results in privilege escalation from an authorized user context to system-level privileges. Microsoft has released a security update addressing this synchronization issue.
Affected products
- Microsoft Windows <UNKNOWN>
Timeline
- 2026-09-08: disclosed