CVE-2026-85333
MediumCVSS 6.7Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
A race condition vulnerability (concurrent execution using a shared resource with improper synchronization) in Windows Performance Monitor allows an authorized attacker to elevate privileges locally.
Risk Assessment
An authorized attacker with local access may gain higher privileges on the system. This can lead to full host compromise.
Recommendation
Apply Microsoft security updates for Windows Performance Monitor. Restrict local access to trusted users.
Other vulnerabilities in Windows Performance Monitor
See all- CVE-2026-85359High
Improper control of generation of code ('code injection') in Windows Performance Monitor allows an authorized attacker to elevate privileges locally.
- CVE-2026-69324High
Access of resource using incompatible type ('type confusion') in Windows Performance Monitor allows an authorized attacker to elevate privileges locally.
- CVE-2026-42981High
An integer underflow vulnerability in Windows Performance Monitor allows an unauthorized attacker to execute code remotely over a network.
- CVE-2026-42974High
An integer overflow vulnerability in Windows Performance Monitor allows an unauthorized attacker to execute code remotely over a network.
Original NVD description (English source)
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Performance Monitor allows an authorized attacker to elevate privileges locally.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS