CVE-2026-69820 – Windows Hello Elevation of Privilege Vulnerability

CVE-2026-69820 is a heap-based buffer overflow vulnerability in Windows Hello that allows an authorized local attacker to elevate privileges. Successful exploitation could give the attacker Virtual Trust Level 1 (VTL1) privileges. No exploitation or public disclosure is reported, and exploit code maturity is listed as unproven.

CVSS SCORE: 8.2.

SEVERITY: Critical.

THREAT: The vulnerability creates a privilege-escalation threat on affected Windows systems. An attacker with existing high privileges and local access could exploit the Windows Hello heap-based buffer overflow to obtain VTL1 privileges. Successful exploitation could have a high impact on confidentiality, integrity, and availability.

EXPLOITS: Exploitation is assessed as unlikely. The vulnerability is not publicly disclosed and is not reported as exploited. Exploit code maturity is unproven, so the source does not confirm the existence of public exploit code, zero-day exploitation, or proof-of-concept exploit code.

TECHNICAL SUMMARY: CVE-2026-69820 is a heap-based buffer overflow, classified as CWE-122, in Windows Hello. It allows an authorized attacker to perform local privilege escalation. The CVSS metrics specify a local attack vector, low attack complexity, high privileges required, no user interaction, and changed scope. A successful attacker could gain VTL1 privileges, with potentially high confidentiality, integrity, and availability impact. Although the CVSS metrics list attack complexity as Low, the supplied FAQ separately states that successful exploitation requires deep system knowledge and depends on factors such as the environment, configuration, and additional security measures.

EXPLOITABILITY: Affected products include Windows 10 versions 21H2 and 22H2 for listed 32-bit, ARM64, and x64 systems, and Windows 11 versions 23H2, 24H2, 25H2, and 26H1 for listed ARM64 and x64 systems. Exploitation requires local access and high privileges, but no user interaction.

BUSINESS IMPACT: Successful exploitation could elevate an authorized local attacker to VTL1 privileges. The potential high impact to confidentiality, integrity, and availability makes this flaw significant for organizations running affected Windows endpoints. “A foothold with high privileges could become access to an even more powerful trust level.”

WORKAROUND: No workaround or mitigation is identified. An official fix is available, and the affected-software entries indicate that a restart is required.

URGENCY: This vulnerability is rated Critical with a CVSS base score of 8.2 and potentially high confidentiality, integrity, and availability impact. Organizations should prioritize deployment of the official fix across affected Windows systems despite exploitation currently being assessed as unlikely.