Windows Performance Monitor improperly controls code generation, allowing a local attacker to inject and execute code with elevated privileges. The flaw is a classic code injection vulnerability documented by CWE‑94, enabling the attacker to gain higher access rights within the system.

Microsoft Windows 10 releases 1607, 1809, 21H2, 22H2 and Windows 11 releases 23H2, 24H2, 25H2, 26H2, plus 26H1, as well as Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including the ARM64 variants for Windows 11. All these versions are affected by the code injection weakness.

The CVSS score is 7.8, indicating a high severity local privilege escalation. EPSS data is not available, and the vulnerability requires local user access without an external attack vector. It is not listed in CISA’s KEV catalog, but the high CVSS combined with the local nature of the attack presents a significant risk to any system where Performance Monitor is accessible to non‑privileged users.