Windows HID CVE-2026-69472

The attacker must have an interactive local or Remote Desktop session on the targeted Windows system (AV:L), authenticated with at minimum a standard low-privilege user account (PR:L). No user interaction from a second user is required (UI:N). Exploitation is further constrained by high attack complexity (AC:H), almost certainly a kernel-level race condition in HID object lifecycle management that requires precise timing or a specific device-state trigger sequence - reliable exploitation likely requires multiple attempts or custom tooling. No special HID hardware, non-default Windows configuration, or specific peripheral device appears to be required based on available description data. Purely remote exploitation without a prior session is not possible (AV:L). The primary limiting factors for defenders are: requirement for a valid local/RDP session and the high-complexity exploit trigger.

The CVSS 7.0 score accurately reflects the constrained attack path: AV:L limits the attack to users already on the machine, PR:L requires at minimum a standard domain or local account, and AC:H indicates the exploit is not push-button - almost certainly a kernel race condition needing precise timing. The full C:H/I:H/A:H impact is real but only realizable post-exploitation of that complex trigger. Even a mid-sized municipal IT team in kielce managing a shared terminal-server estate should treat this as a meaningful lateral-movement risk, because standard user accounts are exactly the foothold threat actors commonly hold after phishing. No CISA KEV listing and no known public PoC keep immediate urgency moderate, but the breadth of affected Windows versions - spanning nearly a decade of releases - and the ubiquitous deployment of the HID subsystem mean patch coverage must be thorough. EPSS data was not provided in the input and cannot be independently assessed; the AC:H constraint suggests exploitation probability in practice is lower than the CVSS base score alone implies.

A threat actor with a low-privilege domain account - obtained via phishing or credential reuse - logs into a Windows terminal server and executes a specially crafted binary that races against HID kernel object teardown, winning the race to corrupt freed memory and redirecting kernel execution flow to a controlled payload. Upon achieving SYSTEM privileges, the attacker can dump credentials from LSASS, disable endpoint protection, or pivot laterally. No public proof-of-concept is known, so reliably triggering the race condition requires significant kernel exploitation expertise.