Windows DCOM Server CVE-2026-69284

Exploitation requires a locally authenticated session with at least low privileges on the target system (PR:L per CVSS vector). Any standard Windows user account is sufficient - no administrative rights are needed to submit DCOM requests to the server process. DCOM Server is enabled and runs by default on all supported Windows installations; no special feature, non-default configuration, or specific deployment mode is required to expose the vulnerable code path. Exploitation is strictly local (AV:L): an attacker cannot reach this vulnerability directly over the network without first obtaining local code execution on the host (e.g., via an initial-access exploit, VPN session, or RDP access). Scope is unchanged (S:U) - the overflow does not directly pivot to other systems, but achieving SYSTEM on the local host provides a strong basis for lateral movement and credential harvesting.

CVSS 3.1 rates this 7.8 (High) with AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The local attack vector (AV:L) bounds the direct exposure - remote exploitation is not directly possible - but PR:L confirms that any standard authenticated local session is sufficient, removing the most common practical barrier to LPE exploitation. AC:L and UI:N together indicate that no special race conditions, user actions, or non-default configurations are required once local access is established. No EPSS data was provided in the available intelligence; the absence of both a public exploit and a CISA KEV listing reduces immediate triage urgency relative to actively exploited issues. However, the extraordinary breadth of affected versions - including end-of-life Windows Server 2012 and 2012 R2 where patching requires Extended Security Updates - means the aggregate unpatched surface will remain large for an extended period. The heap overflow target is a universally running, highly privileged Windows service; any organization treating this as a low-priority patch risks leaving a reliable privilege escalation primitive open to any attacker who achieves initial foothold.

An attacker who has gained a standard user session on a Windows host - for example, through credential phishing or exploitation of a network-exposed initial-access vulnerability - submits a crafted DCOM activation or interface-marshaling request to the locally running DCOM Server process. The malformed request triggers a heap buffer overflow (CWE-122), corrupting heap metadata or overwriting a function pointer within the SYSTEM-privileged process, enabling the attacker to redirect execution and obtain SYSTEM-level code execution. No public exploit code has been identified at time of analysis, but AC:L and UI:N indicate that weaponization from an established low-privilege foothold would be technically straightforward.