Microsoft Windows Health and Optimized Experiences Service Local Privilege Escalation Exploit (CVE-2026-85884)

Windows Health and Optimized Experiences Service accepts a Microsoft.Windows.Diagnostics.Lua ETW workflow event containing an attacker-controlled Lua module path without adequately authenticating the event producer. The module performs the following steps: Generates a per-run x86_64 launcher containing a LittleInjectorEgg CORE Impact agent. Stages the short-lived launcher and prepares unique temporary Lua module and trace paths. Emits a Microsoft.Windows.Diagnostics.Lua ETW workflow start event referencing the controlled Lua module. Maintains the required trace interval and emits the matching workflow stop event. Causes the LocalSystem WHESVC process to execute the Lua module and launch the staged injector. Transfers the agent into spoolsv.exe, waits for the privileged callback, and removes temporary artifacts on a best-effort basis.