A null pointer dereference vulnerability in Windows Performance Counters enables an authenticated local attacker to gain elevated system privileges.

The vulnerability is a null pointer dereference (CWE-476) within the Windows Performance Counters component. An attacker with low-level local access can trigger this flaw to execute code with elevated privileges on the target machine.

Successful exploitation allows a low-privileged user to gain full control over the affected system. With a CVSS score of 7.8, this vulnerability presents a high risk to organizational security, as it facilitates lateral movement and the potential compromise of sensitive data residing on endpoint devices.

Immediate Action: Apply the relevant security updates provided in the Microsoft Security Update Guide for CVE-2026-25165 to all affected Windows versions.

Proactive Monitoring: Monitor system logs for unexpected crashes or error events related to performance counter processes, which may indicate attempted exploitation.

Compensating Controls: Ensure that local user permissions follow the principle of least privilege to minimize the potential impact of an account compromise.

Public Exploit Available: Unknown

Given the severity of potential privilege escalation, organizations should prioritize the deployment of the vendor-supplied patches across all managed Windows endpoints. Testing and validation of these updates should be conducted in a staging environment prior to a full-scale production rollout to ensure system stability.