Windows Autopilot CVE-2026-65779

Exploitation requires an attacker to possess an existing authenticated local session with at least low-privilege access (confirmed by PR:L in the CVSS vector) on a Windows 11 device running one of the affected Autopilot-integrated builds. Attack complexity is rated High (AC:H), indicating that successful exploitation is not deterministic and likely depends on winning a race condition, achieving a specific heap layout, or triggering a precise timing window - constraining reliable exploitation to skilled adversaries. No user interaction is required once conditions are met (UI:N). Exploitation is limited by: the mandatory requirement for an existing local session eliminating unauthenticated remote attack paths; the AC:H constraint significantly reducing opportunistic or automated exploitation; and applicability only to Windows 11 versions 24H2, 25H2, and 26H1 below the fixed build thresholds. Systems running other Windows versions or fully patched Windows 11 builds at or above the fixed build numbers are not affected.

The CVSS 7.0 base score (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) correctly captures a serious but constrained threat. The local attack vector and high attack complexity together meaningfully limit the exploitability: an attacker cannot reach this vulnerability remotely and must first obtain a low-privileged session on the target, then successfully trigger a complex memory condition - likely a race or heap spray - before gaining SYSTEM. No EPSS data was provided in the source intelligence, so probabilistic exploitation likelihood cannot be quantified. The vulnerability is not listed in CISA KEV, and no proof-of-concept has been identified, indicating no confirmed active or widespread exploitation at time of analysis. The 'Denial Of Service' tag adds a secondary risk: even a failed exploitation attempt may crash an Autopilot-related service, producing operational disruption. For enterprises with strict insider-threat models or shared-access devices (kiosk, lab, shared workstations enrolled via Autopilot), this warrants prompt patching. For tightly controlled single-user endpoints, the AC:H constraint reduces urgency relative to remote-exploitation flaws.

A low-privileged domain or local account holder on a Windows 11 device enrolled in Windows Autopilot crafts a sequence of memory allocation and release operations against the vulnerable Autopilot service or associated driver to trigger the use-after-free condition. By timing the exploit to win the required race condition - reclaiming the freed memory region with attacker-controlled data - the attacker overwrites a privileged kernel structure such as a security token or function pointer, redirecting execution to arbitrary code running as SYSTEM. No public proof-of-concept has been identified, meaning reliable exploitation currently requires sophisticated memory corruption expertise.