Windows Diagnostic Policy Service: Race condition leads to local privilege escalation
Summary
A race condition (CWE-362) and use-after-free issue (CWE-416) in the Windows Diagnostic Policy Service allows an authorized local user to elevate privileges. The attacker needs an existing low-privilege session and must win a timing race, which makes exploitation less reliable (attack complexity high). Successful exploitation can lead to full compromise of the affected host.
Affected
- Windows 11 version 24H2: 10.0.26100.0 before 10.0.26100.9974
- Windows 11 version 25H2: 10.0.26200.0 before 10.0.26200.9974
- Windows 11 version 26H1: 10.0.28000.0 before 10.0.28000.3501
- Windows 11 version 26H2: 10.0.26300.0 before 10.0.26300.9974
- Windows Server 2025 (including Server Core): 10.0.26100.0 before 10.0.26100.33822
Fixed in
- Windows 11 24H2, 25H2 and 26H2: November 2026 cumulative update KB5132061 (builds 10.0.26100.9974, 10.0.26200.9974, 10.0.26300.9974)
- Windows 11 26H1: KB5132059 (build 10.0.28000.3501)
- Windows Server 2025: build 10.0.26100.33822 (KB number: unknown)
Workaround
Unknown. Microsoft has not published a workaround. Applying the security update is the remedy.
Exploitation
- No evidence of exploitation in the wild found.
- CISA SSVC assessment: exploitation none, automatable no, technical impact total.
- No public proof of concept found.
- Not found in CISA KEV in the checks performed (limited check).
Our recommendation
- Install the November 2026 security updates (KB5132061, or KB5132059 for 26H1) and Windows Server 2025 build 10.0.26100.33822 or later, prioritizing shared, multi-user, and terminal server systems.
- If installation fails (error 0x800f0993), retry or install manually.
- Verify builds with winver after patching.
- Also ensure the October 2026 fix for related CVE-2026-83915 is installed.
- Limit local accounts and standard-user rights, and use application allow-listing to reduce the chance of an attacker gaining a local foothold.
- Re-check NVD and CISA KEV, since analysis was pending at publication.
Information from Microsoft (Patch Tuesday November 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- MSRC Security Update Guide: CVE-2026-95976 msrc.microsoft.com
- CVE Record CVE-2026-95976 www.cve.org
- Microsoft KB5132061 security update (Windows 11) support.microsoft.com
- Microsoft November 2026 Patch Tuesday outlook (KB5132059 for 26H1) cyberinsider.com
- KB5132061 installation failures (secondary source) joho-todai.com
- MSRC Security Update Guide: CVE-2026-83915 (related race condition EoP) msrc.microsoft.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 07:54.
Original description (NVD)
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Diagnostic Policy Service allows an authorized attacker to elevate privileges locally.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.