CVE-2026-56198

Microsoft Trace Data Helper Elevation of Privilege Vulnerability

Published Sep 8, 2026 CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Description

Out-of-bounds read in Microsoft Trace Data Helper allows an authorized attacker to elevate privileges locally.

Analysis

Technical impact

Microsoft Trace Data Helper contains an out‑of‑bounds read that can be triggered by an authorized local user. The flaw allows the attacker to read beyond the intended memory boundary, potentially enabling escalation of privileges on the affected system. This vulnerability is a classic memory corruption issue identified as CWE‑125.

Affected Systems

Affected by variants of Windows 11 (V24H2, V25H2 and V26H1) as well as Windows Server 2025, including the Server Core installation. The affected architectures are Arm64 for the Windows 11 V24H2 and V25H2 releases and x64 for V26H1.

Risk and Exploitability

The Microsoft security advisory assigns a CVSS score of 7.8, indicating high severity. EPSS data is not available, so the exact exploitation likelihood cannot be quantified, and the vulnerability is not listed in the CISA KEV catalogue. The attack vector is local; an attacker must have authenticated or otherwise authorized access on the host to exploit the flaw, after which they may gain elevated privileges within that session.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Microsoft

Windows 11 Version 24H2

affected

Version	Status	Constraints
`10.0.26100.0`	affected	< 10.0.26100.9445

Microsoft

Windows 11 Version 25H2

affected

Version	Status	Constraints
`10.0.26200.0`	affected	< 10.0.26200.9445

Microsoft

Windows 11 version 26H1

affected

Version	Status	Constraints
`10.0.28000.0`	affected	< 10.0.28000.2954

Microsoft

Windows Server 2025

affected

Version	Status	Constraints
`10.0.26100.0`	affected	< 10.0.26100.33438

Microsoft

Windows Server 2025 (Server Core installation)

affected

Version	Status	Constraints
`10.0.26100.0`	affected	< 10.0.26100.33438

Configuration 1 [-]

OR	cpe:2.3:o:microsoft:windows_11_24h2:::::::arm64:*
	cpe:2.3:o:microsoft:windows_11_24h2:::::::x64:*
	cpe:2.3:o:microsoft:windows_11_25h2:::::::arm64:*
	cpe:2.3:o:microsoft:windows_11_25h2:::::::x64:*
	cpe:2.3:o:microsoft:windows_11_26h1:::::::arm64:*
	cpe:2.3:o:microsoft:windows_11_26h1:::::::x64:*
	cpe:2.3:o:microsoft:windows_server_2025::::::::

No data.

Vendor Product Versions

Microsoft

Windows 11 24h2

Version	Status	Scheme	Platform
`[10.0.26100.0,10.0.26100.9445)`	affected	generic	['arm64-based_systems', 'x64-based_systems']

Microsoft

Windows 11 25h2

Version	Status	Scheme	Platform
`[10.0.26200.0,10.0.26200.9445)`	affected	generic	['arm64-based_systems', 'x64-based_systems']

Microsoft

Windows 11 26h1

Version	Status	Scheme	Platform
`[10.0.28000.0,10.0.28000.2954)`	affected	generic	['arm64-based_systems', 'x64-based_systems']

Microsoft

Windows Server 2025

Version	Status	Scheme	Platform
`[10.0.26100.0,10.0.26100.33438)`	affected	generic	['x64-based_systems']

Microsoft

Windows Server 2025 (server Core Installation)

Version	Status	Scheme	Platform
`[10.0.26100.0,10.0.26100.33438)`	affected	generic	['x64-based_systems']

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the official Windows security update for CVE-2026-56198 from Microsoft (see https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56198)
Enforce least‑privilege for local accounts and disable unnecessary administrative privileges to limit the impact of any local privilege escalation attempt
Monitor security and audit logs for anomalous privilege changes and take corrective action immediately if suspicious activity is detected

Generated by OpenCVE AI on September 8, 2026 at 19:45 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.333% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56198

History

Sep 29, 2026 4:45 PM Affected versions updated View changes

Type	Values Removed	Values Added
CPEs		cpe:2.3:o:microsoft:windows_11_24h2:::::::arm64:* cpe:2.3:o:microsoft:windows_11_24h2:::::::x64:* cpe:2.3:o:microsoft:windows_11_25h2:::::::arm64:* cpe:2.3:o:microsoft:windows_11_25h2:::::::x64:* cpe:2.3:o:microsoft:windows_11_26h1:::::::arm64:* cpe:2.3:o:microsoft:windows_11_26h1:::::::x64:*

Sep 9, 2026 7:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Sep 8, 2026 8:30 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Microsoft windows 11 24h2 Microsoft windows 11 25h2 Microsoft windows 11 26h1 Microsoft windows Server 2025 (server Core Installation)
Vendors & Products		Microsoft windows 11 24h2 Microsoft windows 11 25h2 Microsoft windows 11 26h1 Microsoft windows Server 2025 (server Core Installation)

Sep 8, 2026 5:30 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Out-of-bounds read in Microsoft Trace Data Helper allows an authorized attacker to elevate privileges locally.
Title		Microsoft Trace Data Helper Elevation of Privilege Vulnerability
First Time appeared		Microsoft Microsoft windows 11 24h2 Microsoft windows 11 25h2 Microsoft windows 11 26h1 Microsoft windows Server 2025
Weaknesses		CWE-125
CPEs		cpe:2.3:o:microsoft:windows_11_24H2:::::::arm64:* cpe:2.3:o:microsoft:windows_11_25H2:::::::arm64:* cpe:2.3:o:microsoft:windows_11_26H1:::::::x64:* cpe:2.3:o:microsoft:windows_server_2025::::::::
Vendors & Products		Microsoft Microsoft windows 11 24h2 Microsoft windows 11 25h2 Microsoft windows 11 26h1 Microsoft windows Server 2025
References		https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56198
Metrics		cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C'}`

Subscriptions

Microsoft Windows 11 24h2 Windows 11 24h2 Windows 11 25h2 Windows 11 25h2 Windows 11 26h1 Windows 11 26h1 Windows Server 2025 Windows Server 2025 (server Core Installation)

Weaknesses