Windows Image Acquisition CVE-2026-69341

Exploitation requires an authorized (authenticated) low-privilege local user account on the target Windows system - the attacker must already have the ability to execute code locally (AV:L/PR:L). The High Attack Complexity (AC:H) metric indicates that reliable exploitation requires specific timing or heap-state conditions, typically a race condition, meaning a degree of exploit engineering is necessary and exploitation is not straightforwardly automatable. The WIA subsystem must be present and its service active on the target host (default on desktop Windows; potentially disabled on locked-down server builds). No specific non-default configuration or feature enablement is documented as a prerequisite beyond baseline Windows with the WIA service running. Exploitation is limited to scenarios where the attacker already holds a foothold on the machine; remote unauthenticated exploitation is not possible.

The CVSS 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) vector accurately characterizes this as a meaningful but non-trivial LPE. Attack complexity is High, meaning reliable exploitation requires additional engineering - typically a race condition or heap-grooming sequence - reducing immediate opportunistic risk compared to AC:L primitives. The vulnerability requires an authorized low-privilege local user, limiting the threat to scenarios where an attacker already has local code execution (insider, compromised user account, or as a second stage after initial access). No EPSS score was provided; given no KEV listing and no confirmed POC, real-world exploitation probability at time of analysis is low-to-moderate. The primary risk is use within multi-stage attack chains: an adversary who achieves unprivileged local access (phishing, drive-by) can leverage this UAF to escalate to SYSTEM and fully compromise the host. The breadth of affected Windows versions - including end-of-mainstream-support Server 2012 R2 still present in many environments - extends the practical attack surface. The Denial of Service tag in the input metadata is inconsistent with the described primary impact of privilege escalation; this may reflect a secondary crash-mode of the same UAF but is not independently confirmed.

An attacker who has obtained a low-privilege domain or local user account - for example, through credential phishing or an earlier exploitation stage - logs into or runs code on a target Windows system. They invoke Windows Image Acquisition APIs in a specifically crafted sequence to trigger the use-after-free, winning a heap race condition to place controlled data at the freed memory region, and subsequently execute arbitrary code in the context of a privileged process. This gives the attacker SYSTEM-level access, enabling credential dumping, persistence installation, and lateral movement.