CVE-2026-33828: Windows Device Health Attestation (DHA) Elevation of Privilege Vulnerability

Synopsis

A trust boundary violation (elevation of privilege) affects the Windows Device Health Attestation service across multiple versions of Windows 10 and Windows 11. The vulnerability is exploited locally by an attacker who already holds a low-privilege account on the target system, with no network exposure or victim interaction required. Successful exploitation gives the attacker full control over the host, including the ability to read, modify, and delete data or crash services. Patched-image rebuilds at the fixed Windows versions are available on HarborGuard for environments running an affected image.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network path to the service is required.

• AuthenticationRequired

  Any low-privilege local account is sufficient; the attacker does not need administrative credentials.

• Victim interactionNot required

  No user interaction of any kind is needed; the attacker executes the exploit entirely on their own.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special race conditions or environmental setup.

Blast Radius

• Reads sensitive data accessible to the Windows Attestation service, including credentials, keys, and health-state records stored on the host.
• Modifies system files, configuration, and persisted data at an elevated privilege level.
• Deletes or corrupts files and audit logs that the compromised process can reach.
• Crashes or disables host services by exercising elevated control over process and resource management.