Missing authentication for a critical function in the Windows Health and Optimized Experiences Service allows an authorized attacker to elevate privileges locally to SYSTEM. Low-privileged code with access to the Windows diagnostics workflow can trigger a trusted Event Tracing for Windows (ETW) event containing an attacker-controlled Lua module path. The `whesvc` service can then execute that module through WinDiag without properly validating the producer or restricting the module location.