Heap-based buffer overflow in Windows Display Enhancement Service allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow (CWE-122) in the Windows Display Enhancement Service (microsoft.graphics.display.displayenhancementservice.dll) sensor-device-id RPC handlers, local EoP to SYSTEM. The service exposes RPC methods that accept a sensor device-id string from the client - DeManagementRpcServerSetAmbientLightSensorDeviceId, DeManagementRpcServerSetColorLightSensorDeviceId (and OpenFromMonitorId). PRE: the handlers only null-checked the client-supplied device-id string (param_2) and then used it (building a std::wstring / copying it) without validating its length, so an over-long device id overflowed the heap buffer. Because the service runs as SYSTEM and the RPC interface is reachable by a local user, the overflow is a local EoP-to-SYSTEM primitive. Diff of the service DLL 10.0.26100.8972 -> .9168 (Aug 11 2026, KB5121003) confirms the fix: gated behind CFR flag Feature_702787896, the handlers now call a new validator IsValidSensorDeviceId(param_2) before using the id - IsValidSensorDeviceId returns true only when the string is non-null and wcsnlen(id, 0x401) < 0x401 (i.e. length bounded below 1025 WCHARs) - so an over-long device id is rejected (if (!feature || IsValidSensorDeviceId(param_2)) { ...use... }), closing the heap overflow.

An over-long sensor device-id sent to the Display Enhancement Service RPC overflows a heap buffer

Derived from the patch delta: the checks added by the vendor identify which fields crossed a trust boundary unvalidated. Reachability and privilege are taken from the call chain in the RCA report.

Anonymous