CVE-2026-69740 – Windows Hello Elevation of Privilege Vulnerability

A use-after-free vulnerability in Windows Hello could allow an authorized local attacker to elevate privileges. Successful exploitation could grant Virtual Trust Level 1 (VTL1) privileges and result in high impact to confidentiality, integrity, and availability. The vulnerability affects multiple Windows 11 releases on both x64 and ARM64 systems.

CVSS SCORE: 8.8.

SEVERITY: Critical.

THREAT: The vulnerability creates a privilege-escalation threat on affected Windows 11 systems. An attacker requires local access and low privileges, but no user interaction is required. Successful exploitation could cross a security boundary and provide VTL1 privileges, with potentially high confidentiality, integrity, and availability impact.

EXPLOITS: Microsoft assesses exploitation as unlikely. The vulnerability is not publicly disclosed and is not known to be exploited. Exploit code maturity is listed as unproven, so no confirmed public or zero-day exploitation or proof-of-concept exploit code can be established.

TECHNICAL SUMMARY: CVE-2026-69740 is caused by a use-after-free weakness (CWE-416) in Windows Hello. This type of memory-safety issue occurs when software continues to reference memory after it has been freed. The vulnerability can be used by an authorized attacker to elevate privileges locally. The CVSS metrics identify a local attack vector, low privileges required, no user interaction, and changed scope. Successful exploitation could provide VTL1 privileges and have high impact on confidentiality, integrity, and availability. The source contains conflicting attack-complexity information: the CVSS metrics specify Low, while the FAQ describes attack complexity as High and says exploitation requires deep system knowledge and depends on environmental and configuration factors.

EXPLOITABILITY: Affected systems are Windows 11 versions 23H2, 24H2, 25H2, and 26H1 on x64 and ARM64 architectures. Exploitation requires an authorized attacker with local access and low privileges; no user interaction is required.

BUSINESS IMPACT: Successful privilege escalation could give an attacker powerful access beyond their existing permissions, potentially exposing sensitive information, enabling unauthorized changes, and disrupting affected systems. For organizations, compromising a privileged Windows security boundary can significantly increase the impact of an attacker who already has limited local access.

WORKAROUND: No mitigations or workarounds are identified. An official fix is listed, and the affected software entries indicate that a restart is required.

URGENCY: This vulnerability is rated Critical with a CVSS base score of 8.8. Although exploitation is assessed as unlikely and no active exploitation is identified, successful exploitation could grant VTL1 privileges with high confidentiality, integrity, and availability impact. With no workaround identified, deploying the official security update should be prioritized.