Windows Search Service Erhöhung der Privilegien Schwachstelle

This vulnerability allows a local attacker to escalate their privileges on a system running the vulnerable Windows Search Service. An attacker could exploit this to gain control of the entire system, install malicious software, steal sensitive data, or disrupt operations. The impact is particularly severe because the attacker only needs local access to trigger the vulnerability, bypassing many common security controls. Successful exploitation could lead to complete system compromise, similar to privilege escalation vulnerabilities found in other Windows components.

Organizations running Windows 10 versions prior to 10.0.26100.2894 are at risk, particularly those with a large number of user accounts or systems with limited privilege configurations. Environments where local administrative access is frequently granted to non-administrative users are also at increased risk.

• windows / supply-chain:

Get-WinEvent -LogName Security -Filter "EventID = 4688 -MessageText '*\Windows Search*'">

• windows / supply-chain:

Get-Process | Where-Object {$_.ProcessName -like '*searchindexer*'}

• windows / supply-chain: Check Autoruns for unusual entries related to the Windows Search Service. • windows / supply-chain: Monitor Windows Defender for alerts related to privilege escalation attempts involving the Windows Search Service.

1. 2025-01-14Disclosure

   disclosure

1. Reserviert2024-12-10
2. Veröffentlicht2025-01-14
3. Geändert2026-02-13
4. EPSS aktualisiert2026-04-02

The primary mitigation is to apply the security update released by Microsoft, upgrading to version 10.0.26100.2894 or later. If immediate patching is not possible, consider restricting access to the Windows Search Service and implementing stricter user account controls. While a direct workaround is unavailable, ensuring least privilege principles are enforced can reduce the potential impact. After upgrade, confirm the vulnerability is resolved by attempting to reproduce the exploit scenario in a test environment.