Windows Text Shaping CVE-2026-69353

Requires a local authenticated session with standard (low-privileged) user rights on an affected Windows build - no administrative or elevated privileges are needed. The attacker must be able to submit input that reaches the Windows Text Shaping subsystem, which is a default-enabled component invoked by virtually any application that renders text. There is no network-facing attack surface; exploitation cannot occur remotely without first obtaining local access via another vector. Limiting factors: local-only attack vector, requires interactive or programmatic local session, Windows versions at or above the patched build numbers are not affected.

Real-world risk is moderate despite the C:H confidentiality rating. The AV:L constraint means the attacker must already have a local authenticated session - this is not remotely exploitable over a network. The PR:L requirement (standard user privileges) lowers the bar within that constraint; no administrative rights are needed. The AC:L rating indicates no race conditions or special configurations are required once local access is obtained. EPSS data is not provided, and no CISA KEV listing or public proof-of-concept exists at time of analysis, suggesting this has not been weaponized. Compared to the raw CVSS score of 5.5 (Medium), the real-world priority should be assessed against whether multi-tenant or shared-access Windows environments are in scope - Terminal Services, VDI, and Citrix deployments raise risk materially because low-privileged users routinely share process space with higher-privileged workloads. Single-user workstations face comparably lower risk. The breadth of affected versions (Windows Server 2012 through Server 2025) is notable but does not elevate the attack vector.

A low-privileged local user submits specially crafted text - such as a Unicode string with abnormal script-boundary or glyph-table offsets - to an application that invokes the Windows Text Shaping engine (common in any UI rendering context). The out-of-bounds read causes the subsystem to return memory contents beyond the intended buffer, which the attacker can harvest to extract sensitive data co-located in the process heap, potentially including session tokens or cryptographic keys from the same or a co-tenant process. No public proof-of-concept has been identified at time of analysis.