Windows Hello CVE-2026-69799

Exploitation requires an authenticated local account with at least low privileges (PR:L) on the target system - remote unauthenticated exploitation is not possible (AV:L). The attacker must be able to execute code locally, meaning this is not exploitable via network access alone. Attack complexity is high (AC:H) due to the inherent timing requirement of race conditions: the attacker must reliably win the scheduling race against the Windows Hello subsystem, which may require multiple attempts or specific CPU/load conditions. Windows Hello must be configured and active on the system; machines where Windows Hello is disabled or where PIN/biometric enrollment has not occurred may not expose the vulnerable code path. There is no required user interaction beyond the attacker's own execution.

The CVSS 3.1 score of 7.8 (AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) captures the core risk profile accurately: local, low-privilege attacker with high attack complexity due to the race condition timing requirement. AC:H reflects that race conditions are not reliably triggered on demand, reducing automated exploitability. No EPSS data was provided; given the absence of KEV listing and no known POC, real-world exploitation probability is currently moderate at best. However, the scope change and full C:H/I:H/A:H impact mean a successful exploitation yields complete compromise of a higher-integrity process or the operating system. The 'Information Disclosure' tag in the input is factually incorrect - this is a privilege escalation, not an information disclosure vulnerability, and should not influence triage decisions. The high complexity (AC:H) meaningfully lowers risk versus a comparable AC:L local privilege escalation, but Windows Hello's ubiquitous deployment across enterprise endpoints makes this a priority patching candidate despite the timing constraint.

A low-privileged local user (or malware running under a restricted account) launches two concurrent threads targeting a shared Windows Hello authentication object, timing their access to win the race window and overwrite or redirect the object before synchronization completes. If successful, the attacker's thread inherits the elevated security token or context of the Windows Hello process, yielding SYSTEM or equivalent privileges. No public POC has been identified at time of analysis.