CVE-2026-69864 – Windows Hello Elevation of Privilege Vulnerability

CVE-2026-69864 is a critical elevation-of-privilege vulnerability in Windows Hello caused by a use-after-free weakness (CWE-416). An authorized local attacker with low privileges could exploit a race condition to elevate privileges to Virtual Trust Level 1 (VTL1). Exploitation requires high attack complexity but does not require user interaction. The vulnerability is not publicly disclosed and is not currently reported as exploited.

CVSS SCORE: 7.8.

SEVERITY: Critical.

THREAT: Successful exploitation could allow a low-privileged local attacker to gain VTL1 privileges. The CVSS assessment identifies high potential impact to confidentiality, integrity, and availability, making privilege escalation the primary security threat.

EXPLOITS: The vulnerability is assessed as Exploitation Unlikely, with exploit-code maturity listed as Unproven. It is not publicly disclosed and is not reported as exploited. No confirmed public exploit, zero-day exploitation, or proof-of-concept exploit code is identified in the source information.

TECHNICAL SUMMARY: CVE-2026-69864 is a use-after-free vulnerability in Windows Hello. Successful exploitation requires an authorized attacker with low privileges to execute an attack locally and win a race condition, resulting in high attack complexity. No user interaction is required. If successful, the attacker could elevate privileges to Virtual Trust Level 1 (VTL1). The vulnerability has a changed scope and is rated as having high confidentiality, integrity, and availability impact.

EXPLOITABILITY: Affected software includes Windows 10 versions 21H2 and 22H2 and Windows 11 versions 23H2, 24H2, 25H2, and 26H1 across the 32-bit, x64, and/or ARM64 editions listed as applicable. Exploitation requires local access, low privileges, and successfully winning a race condition; no user interaction is required.

BUSINESS IMPACT: An attacker who already has limited local access could use this vulnerability to gain substantially stronger privileges. Successful exploitation could undermine security boundaries and expose organizations to high confidentiality, integrity, and availability impact, increasing the potential for unauthorized access or modification of protected resources.

WORKAROUND: No mitigations or workarounds are identified. An official fix is available, so affected systems should be updated with the applicable security update.

URGENCY: This vulnerability is rated Critical and can enable elevation to VTL1 privileges with no user interaction. Although exploitation is assessed as unlikely and no active exploitation is reported, organizations should prioritize deployment because successful exploitation carries high confidentiality, integrity, and availability impact.