CVE-2026-61355

Imagine a Windows service that receives data from users on the same computer. In this flaw, a logged-in user can send “badly formed” data that makes the service write into memory it shouldn’t touch. That can let the user gain higher administrative power than they started with, and it may also cause crashes or instability.

This matters if you run Windows 10, Windows 11, Windows Server 2022, or Windows Server 2025 and you have any local users who should not be able to tamper with system services. The risk is primarily for anyone who can log in on the machine and interact with the Windows Sensor Data Service locally. It is reachable in default configuration, so you should treat it as a patch priority when untrusted or low-trust local users exist (only a risk if an attacker already has valid login credentials and can interact with the service locally).

This is RED urgency because a low-privilege local user can trigger memory corruption in a Windows system service to elevate privileges. While there’s no dated public exploitation report in the findings, the issue is reachable in default configuration and is fixed in current security updates, so patching should be treated as urgent.

1. Confirm exposure (build check):

   • On each affected machine, check the Windows version and build number (OS build).
   • Compare your build to the fixed builds listed for your specific Windows release.
   • If your build is at or below the versions prior to the listed fixes, you should assume you’re potentially vulnerable.

2. Patch to the fixed version (per branch):

   • Windows 10 → fixed in 10.0.19044.7663 and 10.0.19045.7663
   • Windows 11 → fixed in 10.0.22631.7517, 10.0.26100.9106, 10.0.26200.9106, 10.0.28000.2704, 10.0.26100.9168, 10.0.26200.9168
   • Windows Server 2022 → fixed in 10.0.20348.5440 and 10.0.20348.5499
   • Windows Server 2025 → fixed in 10.0.26100.33222 and 10.0.26100.33296

3. Validate after patching:

   • Re-check the OS build number to confirm it matches one of the fixed versions above.
   • Verify basic system stability and that the Windows Sensor Data Service is operating normally.

4. If patching is delayed (temporary mitigation):

   • Reduce who can log on locally (remove or disable low-trust local accounts).
   • Limit local access paths for users who shouldn’t interact with system services.
   • Treat local login credentials as the risk gate: fewer local users reduces exposure.

5. What to monitor:

   • Look for repeated service crashes/abnormal behavior related to the Windows Sensor Data Service around the timeframe of local activity.
   • Review local authentication activity and any suspicious use by non-admin users on the affected hosts.

6. KEV/known exploitation note:

   • This CVE is not listed in CISA KEV in the provided findings, and no dated public real-world exploitation claim is included there.

CVE-2026-61355 is a Windows Sensor Data Service elevation of privilege issue driven by CWE-122 (heap-based buffer overflow) and memory corruption. The mechanism is a local low-privilege user providing malformed input to the service, causing it to write beyond intended memory limits; this can lead to a crash or the ability to run code with higher administrative rights than the attacker initially had. The findings indicate the vulnerability is reachable in default configuration and requires local credentials (no public exploit code is on record in the provided findings). KEV is not listed, and no clear dated exploitation claim appears in the provided news summary. A patch is available via Microsoft’s update guide, and the provided traffic-light verdict is RED, reflecting the potential for privilege escalation once a local attacker can interact with the service.