Windows Fax Service CVE-2026-69509

Requires a local user session with at minimum a standard (low-privileged) user account on the target Windows system (CVSS PR:L). The Windows Fax Service (fxssvc.exe) must be installed and in a running state - environments that have disabled or removed the Fax Service role are not exposed. No user interaction is required beyond the attacker's own actions (UI:N). The attack does not cross security boundaries to other systems (S:U). Limiting factors: the Fax Service is disabled by default in many modern enterprise configurations, and physical or remote shell access to the local system is a prerequisite, meaning this is a second-stage or post-compromise tool rather than an initial access vector.

Real-world priority is moderate-to-high in environments where Windows Fax Service is actively running, but significantly lower in the many enterprise deployments where the service is disabled or not installed. The CVSS 7.8 score with AC:L and PR:L signals a reliable, post-authentication escalation path - once an attacker has any local foothold (stolen credentials, malware, lateral movement), this provides a straightforward path to SYSTEM. The scope is S:U, limiting blast radius to the local machine rather than enabling cross-system compromise directly. No EPSS data was provided, and the absence of a KEV listing and public POC suggests exploitation is not currently widespread or automated. However, LPE vulnerabilities with AC:L are prime candidates for inclusion in post-exploitation toolkits and ransomware dropper chains. The extremely broad affected version range (19 distinct Windows SKUs/versions) substantially increases the aggregate attack surface. Exploitation risk is gated by whether fxssvc.exe is running - this is the key deployment condition defenders should verify.

An attacker who has gained a standard local user session - via phishing, credential theft, or lateral movement - sends a specially crafted fax-related request or API call to the Windows Fax Service process (fxssvc.exe), triggering a heap buffer overflow that corrupts service memory structures. The overflow redirects execution flow within the service's elevated context, yielding SYSTEM-level code execution and full control of the local machine. No public exploit code has been identified, but AC:L indicates the technique is expected to be reliable without environmental tuning.