Windows NDIS CVE-2026-69396

Exploitation requires a low-privileged authenticated account (local or domain) on the targeted Windows system, per the PR:L CVSS metric. The AC:H rating indicates a race condition or specific heap layout requirement must be satisfied - exploitation is not straightforwardly reliable and likely requires multiple attempts or environmental tuning. The UI:R metric means a specific action by a user or system process is needed to trigger the vulnerable NDIS code path; this likely corresponds to a particular network operation or driver event rather than a passively exploitable socket. The vulnerable NDIS subsystem is present on all networked Windows systems running any of the affected build ranges, so no non-default feature flag or optional component needs to be enabled - any standard networked Windows install is potentially in scope. Exploitation is limited by the pre-existing authentication requirement, high attack complexity, and the need for user interaction.

The CVSS 3.1 score of 7.1 (AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) captures meaningful real-world constraints: the attacker must already hold a low-privileged account, must engineer a specific memory state or race condition (AC:H), and requires some form of user interaction to trigger the vulnerable code path (UI:R). These factors substantially reduce opportunistic or automated exploitation risk relative to a fully unauthenticated, zero-complexity network exploit. No public exploit code has been disclosed and the vulnerability is absent from the CISA KEV catalog, placing it in the category of credible-but-unconfirmed threat. EPSS data was not provided in the available intelligence. Despite the AC:H constraint, the full CIA:H/H/H impact means a successful exploitation achieves complete system compromise - including domain-joined systems where SYSTEM-level access enables credential harvesting and lateral movement. The breadth of affected Windows versions, including Server 2012 which is past end of extended support, warrants prioritized patch deployment especially on systems where untrusted low-privileged users have local or network access.

An attacker with a low-privileged domain account on a Windows system (or network access to one) crafts a network interaction that triggers the NDIS use-after-free - likely by manipulating packet processing timing or driver state to free memory while a reference remains live. Once the freed memory is reallocated with attacker-controlled data, the corrupted kernel object redirects execution to attacker-supplied shellcode running at SYSTEM privilege. No public proof-of-concept exists at time of analysis; developing a reliable exploit requires overcoming AC:H timing conditions and the UI:R prerequisite, making this primarily a risk from skilled, targeted threat actors rather than commodity malware.