CVE-2026-69725 – Windows Hello Elevation of Privilege Vulnerability
CVSS 7.8
IMPORTANT
Critical - Same Day Deployment
“A successful attack could turn limited local access into highly privileged control, putting sensitive Windows protections at risk.”
CVE-2026-69725 is a Windows Hello elevation-of-privilege vulnerability caused by a double-free weakness. An authorized local attacker who successfully exploits the vulnerability could elevate privileges to Virtual Trust Level 1 (VTL1). Exploitation requires low privileges and no user interaction. The source information contains conflicting attack-complexity statements: the CVSS metrics specify Low, while the FAQ states High and says successful exploitation requires winning a race condition.
Key Details
- Attack Vector
- Local
- Attack Complexity
- Low
- Privileges Required
- Low
- User Interaction
- None
- CWE Classification
- CWE-415
Patch this CVE on all your endpoints in under 5 minutes.
First 200 endpoints are free forever, scale as needed.