{"id":"CVE-2026-88241","kind":"vulnerability","aliases":["CVE-2026-88241"],"related":[],"title":"Windows Sensor Data Service: heap overflow lets a local user gain higher privileges","description":"Heap-based buffer overflow in Windows Sensor Data Service allows an authorized attacker to elevate privileges locally.","summary":"A heap-based buffer overflow in the Windows Sensor Data Service lets an attacker who already has a local account raise their privileges. The sources do not describe a remote trigger.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","sensor-data-service","windows"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T19:21:33+00:00","first_seen_at":"2026-11-10T19:25:20+00:00","triaged_at":"2026-11-10T19:38:35+00:00","updated_at":"2026-11-10T19:38:35+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T19:38:35Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Sensor Data Service: heap overflow lets a local user gain higher privileges","impact":"high","summary":"A heap-based buffer overflow in the Windows Sensor Data Service lets an attacker who already has a local account raise their privileges. The sources do not describe a remote trigger.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","sensor-data-service"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains SYSTEM-level privileges on the machine","analyst_note":"Find the affected Windows builds and the Microsoft security update that fixes CVE-2026-88241 in the MSRC advisory; the NVD entry has no product data.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Windows machines running the Sensor Data Service are the systems to look at. The sources do not say which Windows builds or service configurations are affected, and an attacker must already be authorized on the machine, so systems without untrusted local users are lower risk.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00067,"input_tokens":4498,"output_tokens":440,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Find the affected Windows builds and the Microsoft security update that fixes CVE-2026-88241 in the MSRC advisory; the NVD entry has no product data.","search":"'-2026':15A,18A '-88241':16A,19A 'account':46B 'allow':68C 'alreadi':42B 'attack':40B,71C 'author':70C 'base':29B,60C 'buffer':30B,61C 'cve':14A,17A 'data':3A,23B,36B,66C 'describ':54B 'elev':73C 'gain':11A 'heap':5A,28B,59C 'heap-bas':27B,58C 'higher':12A 'infrastructur':20B 'let':7A,38B 'local':9A,45B,75C 'overflow':6A,31B,62C 'privileg':13A,49B,74C 'rais':47B 'remot':56B 'sensor':2A,22B,35B,65C 'sensor-data-servic':21B 'servic':4A,24B,37B,67C 'sourc':51B 'trigger':57B 'user':10A 'window':1A,25B,34B,64C","nicknames":[],"mitigations":[],"who_affected":"Windows machines running the Sensor Data Service are the systems to look at. The sources do not say which Windows builds or service configurations are affected, and an attacker must already be authorized on the machine, so systems without untrusted local users are lower risk.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","infrastructure","sensordataservice","windows"],"campaign_type":null,"search_a":"'-2026':15A,18A '-88241':16A,19A 'cve':14A,17A 'data':3A 'gain':11A 'heap':5A 'higher':12A 'let':7A 'local':9A 'overflow':6A 'privileg':13A 'sensor':2A 'servic':4A 'user':10A 'window':1A","search_b":"'account':46B 'alreadi':42B 'attack':40B 'base':29B 'buffer':30B 'data':23B,36B 'describ':54B 'heap':28B 'heap-bas':27B 'infrastructur':20B 'let':38B 'local':45B 'overflow':31B 'privileg':49B 'rais':47B 'remot':56B 'sensor':22B,35B 'sensor-data-servic':21B 'servic':24B,37B 'sourc':51B 'trigger':57B 'window':25B,34B","search_c":"'allow':68C 'attack':71C 'author':70C 'base':60C 'buffer':61C 'data':66C 'elev':73C 'heap':59C 'heap-bas':58C 'local':75C 'overflow':62C 'privileg':74C 'sensor':65C 'servic':67C 'window':64C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:21:33+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-88241","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88241","severity":null,"published_at":"2026-11-10T19:21:33+00:00","modified_at":"2026-11-10T19:21:33+00:00","first_seen_at":"2026-11-10T19:25:20+00:00","fetched_at":"2026-11-10T19:25:20+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}