CVE-2026-69784 – Windows Hello Elevation of Privilege Vulnerability

CVE-2026-69784 is a critical elevation-of-privilege vulnerability in Windows Hello caused by a use-after-free weakness. An authorized local attacker with low privileges could exploit the vulnerability and gain Virtual Trust Level 1 (VTL1) privileges. No user interaction is required. The vulnerability is not publicly disclosed and is not known to be exploited.

CVSS SCORE: 8.8.

SEVERITY: Critical.

THREAT: An attacker with existing low-privileged local access could attempt to exploit the Windows Hello use-after-free condition to elevate privileges. Successful exploitation could have a high impact on confidentiality, integrity, and availability.

EXPLOITS: The exploitability assessment is Exploitation Unlikely. Exploit Code Maturity is Unproven, and the vulnerability is neither publicly disclosed nor known to be exploited. The source does not confirm the existence of public exploit code, zero-day exploitation, or proof-of-concept code.

TECHNICAL SUMMARY: The vulnerability is a use-after-free condition, identified as CWE-416, in Windows Hello. An authorized attacker can exploit the flaw locally to elevate privileges. Successful exploitation requires winning a race condition, according to the vulnerability FAQ, and could result in VTL1 privileges. The CVSS metrics specify a local attack vector, low privileges required, no user interaction, and changed scope, with high potential impact to confidentiality, integrity, and availability. The source contains conflicting attack-complexity information: the CVSS metrics specify Attack Complexity Low, while the FAQ describes Attack Complexity High and says exploitation requires winning a race condition.

EXPLOITABILITY: Affected products include Windows 10 versions 21H2 and 22H2 on listed 32-bit, ARM64, and x64 systems, and Windows 11 versions 23H2, 24H2, 25H2, and 26H1 on the listed ARM64 and x64 systems. Exploitation requires local access with low privileges and no user interaction.

BUSINESS IMPACT: Successful exploitation could allow an attacker who already has authorized local access to gain VTL1 privileges. This privilege escalation creates the potential for serious compromise because the CVSS assessment identifies high confidentiality, integrity, and availability impact. For organizations, a foothold with limited privileges could therefore become a much more consequential system compromise.

WORKAROUND: No workaround or mitigation is listed. An official fix is identified in the source, so affected systems should receive the applicable security update where possible.

URGENCY: This vulnerability is rated Critical with a CVSS base score of 8.8 and can result in VTL1 privilege elevation. Although exploitation is assessed as unlikely and no active exploitation is reported, the high potential impact across confidentiality, integrity, and availability makes timely deployment important.