CVE-2026-85359
HighCVSS 7.8Exploitation Probability (EPSS)
Elevated risk54th percentile - higher than 54% of all known CVEs
Summary
Improper control of generation of code ('code injection') in Windows Performance Monitor allows an authorized attacker to elevate privileges locally.
Risk Assessment
Risk of privilege escalation in Windows, potentially leading to system compromise by an authorized user.
Recommendation
Install the latest Windows security updates to patch this vulnerability.
Other vulnerabilities in Windows Performance Monitor
See all- CVE-2026-85333Medium
A race condition vulnerability (concurrent execution using a shared resource with improper synchronization) in Windows Performance Monitor allows an authorized attacker to elevate privileges locally.
- CVE-2026-69324High
Access of resource using incompatible type ('type confusion') in Windows Performance Monitor allows an authorized attacker to elevate privileges locally.
- CVE-2026-42981High
An integer underflow vulnerability in Windows Performance Monitor allows an unauthorized attacker to execute code remotely over a network.
- CVE-2026-42974High
An integer overflow vulnerability in Windows Performance Monitor allows an unauthorized attacker to execute code remotely over a network.
Original NVD description (English source)
Improper control of generation of code ('code injection') in Windows Performance Monitor allows an authorized attacker to elevate privileges locally.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS