Windows Power Dependency Coordinator CVE-2026-69459

Exploitation requires an authenticated local session on the target system with at least standard user (low) privileges - consistent with CVSS PR:L. The attacker must have the ability to execute code locally (e.g., via interactive logon, RDP, or malware already running in user context). No special Windows feature, service configuration, or non-default setting is identified as a prerequisite; the Power Dependency Coordinator is a default Windows component present across all affected OS versions. Exploitation is limited to local access only (AV:L) - this cannot be triggered remotely without a prior foothold. No user interaction by a third party is required once local access is established.

The CVSS base score of 7.8 accurately reflects local privilege escalation with low prerequisite privileges. The AV:L vector means this cannot be exploited remotely without a prior foothold - an attacker must have local code execution as a low-privileged user before triggering the overflow. AC:L indicates no race conditions or special configurations are required beyond that foothold, which elevates reliability once access is achieved. No EPSS data was provided in the intelligence feed; however, given the broad Windows ecosystem coverage (twelve distinct OS/version combinations spanning Windows 10 1809 through Windows Server 2025 and Windows 11 26H1), the population of potentially vulnerable endpoints is very large. No KEV listing and no public POC reduces immediate urgency relative to a KEV-confirmed flaw, but local privilege escalation bugs in Windows components are persistently targeted by ransomware operators and APT actors for post-exploitation escalation. The risk is real and warrants prompt patching, particularly in environments with shared workstations, terminal services, or where endpoint compromise is plausible.

An attacker who has already obtained a low-privileged local account on a Windows system - for example, via phishing, credential stuffing, or initial-access malware - sends crafted input to the Windows Power Dependency Coordinator service, triggering a heap-based buffer overflow. By controlling the overflow to corrupt heap metadata or a function pointer, the attacker redirects execution to shellcode or a ROP chain running as SYSTEM. No public proof-of-concept has been identified at time of analysis, but the AC:L rating indicates the overflow is reliably triggerable without complex preconditions.