Windows: Use-after-free elevation of privilege in Perception Simulation Service

Summary

The Windows Perception Simulation Service (PerceptionSimulationService.exe) contains a use-after-free flaw that allows an authorized local attacker to elevate privileges. The attacker needs local access and low privileges, such as a standard user account; the flaw is not reachable from the network. Microsoft lists Windows 10, Windows 11 and Windows Server 2019 as affected, and the service is mainly tied to mixed reality and emulator tooling. Whether the service is installed or running by default is unknown.

Affected

• Windows 10 Version 1809 and Windows Server 2019 (including Server Core): builds below 10.0.17763.9376
• Windows 10 Version 21H2 and 22H2: builds below 10.0.19044.7807 and 10.0.19045.7807
• Windows 11 Version 23H2: builds below 10.0.22631.7652
• Windows 11 Version 24H2, 25H2 and 26H2: builds below 10.0.26100.9711, 10.0.26200.9711 and 10.0.26300.9711

Fixed in

• Windows 10 1809 and Windows Server 2019: build 10.0.17763.9376 or later (October 2026 cumulative update; KB5126651 per a secondary source, verify on the MSRC page)
• Other versions: the corresponding fixed builds listed under affected, or later
• Patch level: check the Microsoft Security Update Guide for the exact KB per version

Workaround

• Unknown. No vendor-documented workaround identified; patching is the remedy.

Exploitation

• Microsoft rates exploit maturity as Unproven (E:U), meaning no known exploit code.
• No public proof of concept, in-the-wild exploitation or CISA KEV entry found.
• CISA SSVC: exploitation none, not automatable, total technical impact.
• EPSS score is low (about 0.0034).

Our recommendation

• Install the October 2026 cumulative update on all affected systems, prioritising Windows 10 1809 and Server 2019.
• Check whether PerceptionSimulationService is present and running; disable it if it is not needed.
• Identify any Windows 10 1809 systems still in use and plan their upgrade, after checking Microsoft's lifecycle page.
• Give extra attention to multi-user terminal servers and shared workstations, as local privilege escalation enables lateral movement and ransomware staging.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-61931 msrc.microsoft.com
• Vulners CVE List (CNA data): CVE-2026-61931 vulners.com
• Vulners NVD: CVE-2026-61931 vulners.com
• BDU:2026-17306 (Vulners) vulners.com
• Strix CVE summary: CVE-2026-61931 www.strix.ai
• Microsoft Learn: Perception simulation overview learn.microsoft.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 04:56.