This vulnerability (CVE-2026-26161) is caused by an untrusted pointer dereference in the Windows Sensor Data Service component of Windows 10 Version 1809 (build 10.0.17763.0). An attacker with authorized local access can exploit this flaw to elevate their privileges, potentially gaining higher-level system permissions. The CVSS 3.1 vector indicates low attack complexity and privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. Microsoft has published an official security update to remediate this vulnerability.

Successful exploitation allows an authorized local attacker to elevate privileges on the affected Windows 10 system, potentially leading to full system compromise. The vulnerability impacts confidentiality, integrity, and availability at a high level. There are no reports of active exploitation in the wild.

An official fix is available from Microsoft. Users and administrators should apply the security update provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26161 to remediate this vulnerability. No additional mitigation steps are indicated by the vendor.