Executive brief
Windows Connected User Experiences and Telemetry is a system service that collects diagnostic data and telemetry on Windows machines. A use-after-free vulnerability allows an authorized local user to gain elevated privileges on an affected system, potentially enabling full system compromise and access to sensitive data.
Technical details
A use-after-free vulnerability exists in the Windows Connected User Experiences and Telemetry service, allowing an authenticated local attacker to escalate privileges. The vulnerability requires the attacker to already have local access to the system. By exploiting the use-after-free condition, an attacker can execute arbitrary code with elevated privileges, bypassing normal access controls. Patches are expected to be available from Microsoft through standard security updates.
Affected products
- Microsoft Windows <UNKNOWN>
Timeline
- 2026-09-08: disclosed