Windows RNDIS CVE-2026-69768

Exploitation requires the target to parse attacker-controlled RNDIS messages through the vulnerable Windows RNDIS driver; per CVSS AV:N/AC:L/PR:N/UI:N no authentication or user interaction is needed once such messages reach the parser. The practical limiting factor is reachability of the RNDIS interface: RNDIS is predominantly a USB-tethering / gadget-and-virtual-NIC protocol, so an attacker generally needs to present a malicious RNDIS peer (rogue USB networking device or an adjacent device speaking RNDIS) rather than exploit an arbitrary internet host - verify true exposure with Microsoft, as the AV:N rating may overstate remote reach. Any current, unpatched Windows 10/11 or Server 2012-2025 build in the listed ranges is vulnerable in default configuration.

The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H = 9.8) describes an unauthenticated, no-interaction, low-complexity network RCE - the most severe profile, and given the ubiquity of Windows it warrants prompt Patch-Tuesday-class remediation across every estate. However, the signals should be weighed carefully: RNDIS is historically a USB/tethering and gadget interface, so despite Microsoft's AV:N rating the practical remote reachability may be narrower than the raw vector implies (adjacency to a rogue RNDIS peer or a system exposing RNDIS may be a real precondition) - organizations should verify actual exposure with Microsoft's MSRC guidance rather than assuming internet-facing reach. No EPSS score, KEV entry, or POC was provided, so exploitation is currently theoretical; the CWE-122 kernel-heap class is nonetheless a historically reliable RCE primitive once weaponized. Given the enormous install base, defenders should treat this as high priority and patch promptly rather than waiting for exploitation evidence.

An attacker with the ability to present a malicious RNDIS peer - for example a rogue USB-networking gadget attached to a workstation, or a hostile device on a segment where a Windows host processes RNDIS traffic - sends crafted RNDIS control messages with manipulated length fields. The undersized heap copy corrupts kernel memory and is shaped into arbitrary code execution at driver privilege. No credentials or user interaction are required per the CVSS vector; no public POC is available at time of analysis.