Windows Key Guard CVE-2026-66799

Exploitation requires an existing local authenticated session on the target Windows system - the description specifies 'authorized attacker,' and the CVSS PR:L metric confirms a low-privileged local user account is sufficient. No special Windows feature, non-default configuration, or specific application state is identified in the provided description as a prerequisite beyond holding a local logon session. What limits exploitation: the attacker must already have local code execution as a non-privileged user (AV:L), ruling out remote unauthenticated attack paths. This is a post-initial-access escalation primitive, not an entry-point vulnerability. Scope is unchanged (S:U), so lateral movement to other systems is not directly enabled by this flaw alone.

The CVSS score of 7.8 with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H accurately reflects a high-severity local privilege escalation. The low attack complexity and lack of user interaction requirement make this straightforward to operationalize once an attacker has any foothold on the target system. The scope is unchanged (S:U), meaning the exploit does not directly pivot to other systems, but full C:H/I:H/A:H impact after escalation means the compromised host is fully owned. No EPSS score, KEV status, or POC data were included in the provided intelligence, making quantitative exploitation likelihood assessment impossible from this dataset. Given the ubiquitous deployment of Windows and the reliability implied by AC:L, this should be treated as a high-priority patch for any organization relying on Windows endpoint security. The primary limiting factor is the requirement for prior local authenticated access - this is not a remote pre-auth vector.

An attacker who has already gained a foothold as a standard local user - via phishing, credential theft, or a remote code execution vulnerability - invokes the Windows Key Guard component with crafted input that triggers the heap-based buffer overflow. No public exploit identified at time of analysis, but AC:L suggests the overflow primitive is reliably reachable. Successful exploitation yields SYSTEM-level privileges, enabling the attacker to disable endpoint defenses, dump credential stores, and establish persistence.