CVE-2026-61355

Imagine a Windows service that receives data from users on the same computer. In this flaw, a logged-in user can send “badly formed” data that makes the service write into memory it shouldn’t touch. That can let the user gain higher administrative power than they started with, and it may also cause crashes or instability.

This matters if you run Windows 10, Windows 11, Windows Server 2022, or Windows Server 2025 and you have any local users who should not be able to tamper with system services. The risk is primarily for anyone who can log in on the machine and interact with the Windows Sensor Data Service locally. It is reachable in default configuration, so you should treat it as a patch priority when untrusted or low-trust local users exist (only a risk if an attacker already has valid login credentials and can interact with the service locally).

This is RED urgency because a low-privilege local user can trigger memory corruption in a Windows system service to elevate privileges. While there’s no dated public exploitation report in the findings, the issue is reachable in default configuration and is fixed in current security updates, so patching should be treated as urgent.