What is the CVSS score of CVE-2026-66799?

CVE-2026-66799 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Windows Key Guard are affected by CVE-2026-66799?

Windows Key Guard local privilege escalation (CVE-2026-66799) enables any authenticated local user to achieve full system compromise through heap buffer overflow exploitation.. A patch is available.

How to fix or mitigate CVE-2026-66799?

Within 24 hours: Inventory all Windows systems with Key Guard deployed and assess whether the component is essential to operations; immediately restrict local user authentication privileges to prevent exploitation by non-administrator accounts where feasible. Within 7 days: Deploy enhanced endpoint detection and response (EDR) or behavior-based monitoring rules to detect exploitation attempts targeting this vulnerability; disable Windows Key Guard entirely if business operations permit, and implement application whitelisting to restrict access. Within 30 days: Monitor vendor security advisories for patch availability and prepare a coordinated deployment plan including testing and rollback procedures; implement privileged access management (PAM) controls to restrict local login capabilities across critical systems.

Windows Key Guard CVE-2026-66799

EUVD-2026-56450 HIGH

Heap-based Buffer Overflow (CWE-122)

2026-08-11 secure@microsoft.com

GHSA-cr27-wq5j-8m89

Buffer Overflow Heap Overflow Microsoft Red Hat Windows 10 1607 Windows 10 1809 Windows 10 21h2 Windows 10 22h2 Windows 11 23h2 Windows 11 24h2 Windows 11 25h2 Windows 11 26h1 Windows Server 2012 Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows Server 2025

7.8

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local vector and low privileges confirmed by 'authorized attacker' phrasing and AV:L/PR:L; full C/I/A impact reflects post-escalation SYSTEM-level control.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Red Hat

7.1 HIGH

qualitative

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Aug 11, 2026 - 18:19 EUVD

Analysis Generated

Aug 11, 2026 - 18:14 vuln.today

CVE Published

Aug 11, 2026 - 17:19 nvd

HIGH 7.8

DescriptionCVE.org

Heap-based buffer overflow in Windows Key Guard allows an authorized attacker to elevate privileges locally.

AnalysisAI

Local privilege escalation in Windows Key Guard exposes any authenticated local user to full system compromise via a heap-based buffer overflow (CWE-122). The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms low-complexity exploitation requiring only a standard local user session - no elevated rights, no user interaction. This class of vulnerability is a staple post-initial-access technique in ransomware and APT intrusion chains. No public exploit identified at time of analysis, and no CISA KEV listing is present in the provided data.

Technical ContextAI

Windows Key Guard is a Microsoft Windows security component. The root cause is CWE-122 (Heap-based Buffer Overflow): attacker-controlled input is written to a heap-allocated buffer without adequate bounds checking, corrupting adjacent heap metadata or function pointers. On Windows, heap corruption of this type can be leveraged to redirect execution flow to attacker-controlled memory or overwrite security-sensitive kernel structures, enabling privilege escalation from a low-integrity user context to SYSTEM or equivalent. The CVSS attack complexity of Low (AC:L) indicates the overflow is reliably and directly triggerable without race conditions or special heap states, making exploitation deterministic. No CPE strings were provided, so exact affected Windows versions cannot be enumerated from this dataset alone.

RemediationAI

Apply the Microsoft security update addressing CVE-2026-66799, available through the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-66799. No specific patched version number was included in the provided intelligence data, so the exact fix version is not independently confirmed - consult the MSRC advisory for the applicable KB article and build number. As a compensating control pending patch deployment, restrict interactive local logon rights to only trusted administrative accounts via Group Policy (User Rights Assignment → 'Allow log on locally'), reducing the pool of principals who could trigger the overflow. Note this mitigation does not eliminate risk for shared or multi-user systems and may disrupt legitimate user workflows. Prioritize patch deployment on high-value endpoints such as domain controllers, build servers, and privileged access workstations.