Microsoft Windows Performance Monitor Integer Underflow Vulnerability Allowing Remote Code Execution

A remote code execution vulnerability has been identified in Windows Performance Monitor. This issue arises from an integer underflow, or wraparound, which allows an unauthorized attacker to execute code over a network. The vulnerability affects multiple Windows 11 versions, Windows Server 2022, and Windows Server 2025.

Impact

Exploitation of this vulnerability could lead to unauthorized remote code execution on the affected system.

Remediation

Users can download the security update for this vulnerability via the Microsoft Update Catalog. For Windows Server 2022, the update is KB5094128. For Windows 11, the updates are KB5095051 for version 26H1, KB5094126 for version 24H2, and KB5093998 for version 23H2. Windows 11 version 25H2 also has an available update, KB5094126. For Windows Server 2025, the security update is KB5094125.