EUVD-2026-73455
GHSA-6cgq-w475-63qx
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local type confusion LPE requiring only a standard user account; no user interaction; full system compromise post-escalation within unchanged scope.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
5DescriptionCVE.org
Access of resource using incompatible type ('type confusion') in Windows Performance Monitor allows an authorized attacker to elevate privileges locally.
AnalysisAI
Type confusion in Windows Performance Monitor enables local privilege escalation across virtually every supported Windows release, from Windows Server 2012 through Windows 11 26H1. An authenticated local user can exploit the flaw to gain full control over confidentiality, integrity, and availability on the affected host. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated local session with at least low-privileged (non-guest) access to the target Windows system - consistent with CVSS PR:L. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N scoring 7.8 is well-calibrated: the attack requires only a low-privileged local account and no user interaction, making it a reliable post-exploitation escalation step or a tool for any user on a multi-tenant Windows system. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the Microsoft Security Response Center patch as distributed through Windows Update or WSUS; the advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69324 lists the exact fixed builds per platform (e.g., Windows Server 2019 ≥10.0.17763.9245, Windows 11 24H2/25H2 ≥10.0.26100.9445, Windows Server 2025 ≥10.0.26100.33438). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Although no public exploit has been identified at time of analysis, the type confusion flaw affects virtually all supported Windows versions and enables full system compromise from any authenticated local user, making rapid patching essential. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-125 – Out-of-bounds Read
View allShare
External POC / Exploit Code
Leaving vuln.today