Windows CVE-2026-69391

Exploitation requires the attacker to hold a valid low-privilege local or domain account with interactive logon rights on the target Windows system (PR:L per CVSS). No victim user interaction is needed (UI:N), and attack complexity is low (AC:L), meaning no race conditions, heap grooming, or non-default configurations are necessary. Exploitation is strictly local (AV:L) - remote unauthenticated attack is not possible. Risk is most significant in multi-user environments such as terminal servers, VDI pools, and enterprise workstations where untrusted personnel hold logon access; it is substantially limited in single-user managed endpoints where local users are already trusted.

CVSS 7.8 (High) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H accurately characterises a local privilege escalation with full triad impact. The low attack complexity indicates no preconditions beyond holding a low-privilege local account - no race condition, heap spray, or special configuration is required. The absence of a KEV listing and the lack of any reported public POC lower the near-term exploitation probability, but the breadth of affected Windows versions (15 distinct SKUs spanning client and server) gives this a very large exposure surface in enterprise environments. The most elevated risk applies to shared-access environments - VDI deployments, terminal servers, and shared workstations - where untrusted local users routinely hold logon rights. In tightly controlled single-user environments where all local users are trusted, real-world risk is significantly lower despite the high CVSS. No EPSS score was provided in input data; this gap should be monitored as POC research matures.

An attacker who has obtained a standard domain or local user account on a shared Windows terminal server submits a specially crafted request to the Broker Infrastructure Service, triggering the stack buffer overflow and overwriting the function return address. Execution is redirected to a ROP chain or injected payload running in the service's elevated security context, granting the attacker SYSTEM-level privileges and full control of the host.