CVE-2026-26161
Published: 14 April 2026
Summary
CVE-2026-26161 is a high-severity Improper Input Validation (CWE-20) vulnerability in Microsoft Windows 10 21H2. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 24.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-26161 is an untrusted pointer dereference vulnerability in the Windows Sensor Data Service. Published on 2026-04-14, it affects Windows systems and carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The issue is linked to CWE-20 (Improper Input Validation) and CWE-822 (Untrusted Pointer Dereference).
A local attacker with low privileges (PR:L) can exploit this vulnerability with low attack complexity and no user interaction required. Successful exploitation enables privilege escalation, granting high-impact access to confidentiality, integrity, and availability of the system.
The Microsoft Security Response Center advisory provides details on mitigation and patches at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26161.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-22386
Vulnerability details
Untrusted pointer dereference in Windows Sensor Data Service allows an authorized attacker to elevate privileges locally.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local untrusted pointer dereference in a Windows service directly enables in-process exploitation to escalate from low-privileged context to SYSTEM/administrator rights (T1068).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Mandates timely remediation of identified flaws, directly addressing this untrusted pointer dereference vulnerability through patching as recommended by Microsoft.
Implements memory protection mechanisms such as DEP and ASLR that prevent exploitation of untrusted pointer dereferences leading to privilege escalation.
Requires validation of inputs to the Windows Sensor Data Service, mitigating the improper input validation (CWE-20) contributing to the untrusted pointer dereference.