COM for Windows CVE-2026-69294

Requires a valid local account with at minimum standard (non-administrative) user privileges on the affected Windows system; remote network access alone is insufficient. The attacker must be able to execute code locally-through an interactive session, Remote Desktop, or Citrix-and must be able to trigger COM error-generating conditions, which is possible with ordinary user-mode API calls. No non-default configuration, no special software, and no additional user interaction is required beyond the attacker's own actions. Exploitation is limited to information disclosure with no integrity or availability impact; it does not directly yield code execution.

The CVSS 5.5 score with a local attack vector reflects a moderate but real risk: low-privileged users on shared or multi-tenant Windows systems-including Remote Desktop servers, enterprise workstations, and Citrix environments-could leverage this to extract sensitive COM-layer data that may include internal addresses useful for bypassing ASLR in follow-on attacks or, in worst cases, credential material. The scope is unchanged (S:U) and there is no integrity or availability impact, so this is a pure information disclosure issue. No EPSS score was provided and the vulnerability is not listed in CISA KEV, indicating no confirmed widespread exploitation. No public proof-of-concept code has been identified. The practical exploitation ceiling is limited by the requirement for local access, but the broad footprint of affected builds-spanning Windows 10 1809 through the latest Windows 11 26H1 and Windows Server 2019 through 2025-means the exposure surface across enterprise environments is substantial.

An attacker with a standard user account on a shared Windows Remote Desktop server intentionally triggers COM subsystem error conditions-for example, by invoking a COM interface with malformed arguments or by exhausting a COM resource-and captures the resulting error message strings. The disclosed data (such as kernel or heap addresses) could be used to defeat address space layout randomization in a subsequent privilege escalation attempt against the same host.