Windows Push Notifications CVE-2026-69280

Exploitation requires a valid, authenticated local user account on the target system (PR:L); unauthenticated or remote exploitation is not possible per the AV:L/PR:L CVSS vector. High attack complexity (AC:H) indicates additional prerequisites beyond mere access - specifically, the attacker must successfully win a race condition or precisely groom the heap to control the freed memory region reliably. No special non-default configuration of Windows Push Notifications is implied as a prerequisite; the service runs by default on affected Windows versions. Limiting factors: exploitation is confined to local access only, requires technical skill to exploit the UAF reliably (AC:H), and does not involve user interaction. Scope is limited to the local vulnerable system (S:U), so lateral movement is not directly achieved by this CVE alone.

The CVSS 7.0 score with vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H accurately characterizes a meaningful but access-constrained local privilege escalation. High attack complexity (AC:H) reflects the precision typically required to reliably exploit a use-after-free - likely involving race conditions or heap-grooming techniques - which meaningfully reduces the realistic attacker pool relative to AC:L vulnerabilities. The requirement for an already-authenticated local account (PR:L) limits the exposure to insider threats, shared or multi-tenant systems, or post-initial-access scenarios where an attacker chains this with another exploit. Even a mid-sized municipal IT team in mielec should treat this as an urgent patching priority, since LPE vulnerabilities of this class are routinely used as second-stage payloads following phishing or web exploitation. EPSS data is absent from the input, CISA KEV listing is not present, and no public proof-of-concept code is noted - all signals point to no confirmed widespread exploitation at this time. The overall real-world priority is moderate-to-high in environments with untrusted or shared local access, but lower for tightly controlled single-user workstations.

An attacker with a low-privileged local user account on a Windows workstation or server triggers the use-after-free condition in the Push Notifications subsystem through a crafted sequence of notification operations, carefully timing memory allocation and deallocation to reclaim the freed object under attacker control. By controlling the reclaimed memory, the attacker redirects execution flow to shellcode or a ROP chain that escalates their process token to SYSTEM. No public exploit code is confirmed available, but the AC:H CVSS metric indicates the technique requires non-trivial heap manipulation skill.