Windows Hello CVE-2026-69725

Exploitation requires an authorized local account with at least low-privileged interactive or programmatic access to the target system - the CVSS PR:L metric confirms a standard user account suffices and no administrative rights are needed prior to exploitation. No user interaction is required beyond the attacker initiating the exploit sequence. The vulnerability is present on any of the six affected Windows release trains regardless of whether Windows Hello is the active sign-in method, though the Hello authentication subsystem must be installed (standard in all affected versions). Exploitation is constrained to local or already-compromised-host contexts (AV:L); remote unauthenticated exploitation is not indicated.

The CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects a realistic local privilege escalation: requires a low-privileged local account, no user interaction, and yields full C/I/A compromise. The low attack complexity designation (AC:L) suggests the trigger condition is reliable once local access is established. No active exploitation is confirmed in CISA KEV, and no public exploit code has been identified. EPSS data is not provided. Despite the high CVSS base score, real-world risk is gated by the AV:L requirement - an attacker must already have interactive or remote shell access at low privilege. This makes it most relevant as a post-initial-access escalation primitive in multi-stage intrusions. The breadth of affected Windows versions (six distinct release trains from 21H2 to 26H1) increases aggregate exposure significantly, making patching a genuine operational priority for enterprise environments.

An attacker with a low-privileged shell on a vulnerable Windows 10 or 11 system - obtained, for example, via phishing or a pre-existing remote code execution vulnerability - crafts a sequence of calls into the Windows Hello subsystem that triggers the double-free condition. The heap corruption is used to overwrite a function pointer or security token structure, allowing the attacker to execute code in a higher-privileged context (e.g., SYSTEM). No public exploit code has been identified, but the AC:L rating suggests the primitive is reliably triggerable once local access exists.