Out-of-bounds write in Windows Hotpatch Monitoring Service allows an authorized attacker to elevate privileges locally.

Out-of-bounds write (CWE-787) in the Windows Hotpatch Monitoring Service hpatchmon.dll ETW event-callback string handling, local EoP to SYSTEM. The Hotpatch Monitoring Service consumes an ETW autologger trace; autologgerProcessor::AutologgerProcessEventCallback and TraceUtil::ProcessEventCallback parse each event's user data (including WCHAR strings) into local buffers/std::wstring. PRE: the callbacks constructed strings from the event-data pointer with an unbounded std::basic_string construction that did not correctly respect the event-data length, so a crafted/oversized trace event drove an out-of-bounds write while copying the string data into the service's buffers. Because the service runs as SYSTEM and the event data is attacker-influenceable, the OOB write is a local EoP-to-SYSTEM primitive. Diff of hpatchmon.dll 10.0.26100.8521 -> .8655 (Jun 9 2026, KB5094126) confirms the fix: gated behind CFR flag Feature_1648861496, both event callbacks now build the strings via a bounded std::basic_string::_Construct<1, unsigned_short const*> (explicit-length construction) with the local string pointers pre-initialized, so the copy is bounded to the actual data length, closing the out-of-bounds write. Note: the callbacks are confirmed code-changed under Feature_1648861496 with the bounded-construction rework; the exact overflowing write is entangled in the string-handling refactor and is stated at confirmed-changed level per the CWE-787 classification.

A crafted ETW autologger event drives an unbounded string copy in the SYSTEM Hotpatch Monitoring Service, writing out of bounds

Derived from the patch delta: the checks added by the vendor identify which fields crossed a trust boundary unvalidated. Reachability and privilege are taken from the call chain in the RCA report.

Dongjun Lee