Windows Diagnostic Policy Serviceの脆弱性で権限が昇格されるおそれ
Summary
Windows Diagnostic Policy Serviceに、競合状態を悪用して権限を昇格される脆弱性が見つかりました。認証済みの攻撃者が端末上で権限を取得するおそれがあり、CVSS v3のスコアは7です。Windows 11 24H2・25H2・26H1・26H2とWindows Server 2025が影響を受けるため、修正版の適用を急いでください。
AI summary
Produced by SecPulse using an external AI model; it may contain mistakes. Check the original description and references below before acting on it.
Windows Diagnostic Policy Serviceに、競合状態を悪用して権限を昇格される脆弱性が見つかりました。認証済みの攻撃者が端末上で権限を取得するおそれがあり、CVSS v3のスコアは7です。Windows 11 24H2・25H2・26H1・26H2とWindows Server 2025が影響を受けるため、修正版の適用を急いでください。
Affected packages
| Package | Affected → Fixed | |
|---|---|---|
| MicrosoftWindows 11 Version 24H2 |
≥ 10.0.26100.0, < 10.0.26100.9974→ 10.0.26100.9974 |
10.0.26100.9974 |
| MicrosoftWindows 11 Version 25H2 |
≥ 10.0.26200.0, < 10.0.26200.9974→ 10.0.26200.9974 |
10.0.26200.9974 |
| MicrosoftWindows 11 version 26H1 |
≥ 10.0.28000.0, < 10.0.28000.3501→ 10.0.28000.3501 |
10.0.28000.3501 |
| MicrosoftWindows 11 Version 26H2 |
≥ 10.0.26300.0, < 10.0.26300.9974→ 10.0.26300.9974 |
10.0.26300.9974 |
| MicrosoftWindows Server 2025 |
≥ 10.0.26100.0, < 10.0.26100.33822→ 10.0.26100.33822 |
10.0.26100.33822 |
| MicrosoftWindows Server 2025 (Server Core installation) |
≥ 10.0.26100.0, < 10.0.26100.33822→ 10.0.26100.33822 |
10.0.26100.33822 |
Original description The description as published by the source.
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Diagnostic Policy Service allows an authorized attacker to elevate privileges locally.
Source: Microsoft Security Response Center Blog NVD GitHub Advisory
References
- web msrc.microsoft.com
- web nvd.nist.gov
- web github.com