CVE-2026-66799 – Windows Key Guard Elevation of Privilege Vulnerability

CVE-2026-66799 is a critical elevation-of-privilege vulnerability in Windows Key Guard caused by a heap-based buffer overflow. An authorized local attacker with low privileges could exploit the flaw to gain Virtual Trust Level 1 (VTL1) privileges. No user interaction is required. The vulnerability is not publicly disclosed and is not known to be exploited.

CVSS Score: 7.8.

SEVERITY: Critical.

THREAT:
The vulnerability can allow an attacker who already has low-level local access to elevate privileges through Windows Key Guard. A successful attack could have a high impact on confidentiality, integrity, and availability. The attack complexity is rated Low, although exploitation requires local access and low privileges.

EXPLOITS:
No exploitation is reported, and the vulnerability is not publicly disclosed. Exploit code maturity is rated Unproven, and exploitation is assessed as Less Likely. The source does not confirm the existence of a public exploit, zero-day exploit, or proof-of-concept exploit code.

TECHNICAL SUMMARY:
CVE-2026-66799 is a heap-based buffer overflow (CWE-122) affecting Windows Key Guard. The flaw can be triggered locally by an authorized attacker with low privileges. Successful exploitation can elevate the attacker's privileges to Virtual Trust Level 1 (VTL1). The CVSS metrics rate attack complexity as Low, privileges required as Low, user interaction as None, and scope as Unchanged, with High potential impact to confidentiality, integrity, and availability.

EXPLOITABILITY:
Affected products include Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 24H2 and 26H1; and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including listed Server Core installations and applicable x86, x64, and ARM64 editions. Exploitation requires local access and low privileges but requires no user interaction.

BUSINESS IMPACT:
Successful exploitation could allow an attacker with existing local access to reach VTL1 privileges, increasing their ability to compromise sensitive system resources. Because confidentiality, integrity, and availability impacts are all rated High, successful privilege escalation could expose sensitive information, enable unauthorized changes, and disrupt affected Windows systems.

WORKAROUND:
No mitigations or workarounds are specified. An official fix is identified, so affected systems should be updated using the applicable security update.

URGENCY:
This vulnerability is rated Critical and affects numerous Windows client and server releases. Although exploitation is assessed as Less Likely and no exploitation is reported, its low attack complexity, lack of required user interaction, and potential for VTL1 privilege escalation make timely deployment important.