Windows Kerberos CVE-2026-69822

Exploitation requires a locally authenticated session with at least standard (non-administrative) user privileges, consistent with the CVSS PR:L metric. The attacker must be able to execute code locally - via interactive logon, RDP, SSH with a Windows shell, or a low-privileged process. No special Kerberos configuration, non-default setting, or specific domain topology is required; Kerberos authentication is the default in Windows Active Directory environments and is present in all affected builds. Exploitation does not require user interaction (UI:N). The primary factor limiting real-world risk is the requirement for prior local code execution - this is not a remotely exploitable, unauthenticated attack path. Network-accessible services running as low-privileged users (e.g., IIS application pool identities) on affected Windows hosts represent a plausible second-stage escalation target.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) is well-calibrated: local access with a standard user account is the only prerequisite, attack complexity is low, and no user interaction is needed. In practice, this makes the vulnerability a high-value post-compromise privilege escalation primitive - once an attacker achieves any foothold via phishing, credential reuse, or another bug, this can complete the SYSTEM takeover with minimal friction. EPSS data was not provided in the input, and CISA KEV listing is not confirmed, so no public exploitation is established; however, the low attack complexity (AC:L) suggests reliable exploitability by a skilled attacker, and even a mid-sized municipal IT team in walbrzych should treat this as urgent given the breadth of affected Windows versions and the role local escalation plays in ransomware and APT chains. The root cause description ('numeric truncation error') and the assigned CWE-122 (Heap-based Buffer Overflow) are consistent as cause and consequence respectively - not a metadata error - though independent vendor confirmation of the exact overflow mechanism is not available in the provided data.

An attacker who has obtained a standard (non-privileged) local Windows user account - through phishing, password spray, or initial exploitation of a separate vulnerability - initiates a crafted Kerberos authentication sequence that triggers the numeric truncation error in the Windows Kerberos subsystem. The resulting undersized heap allocation is overflowed with attacker-influenced data, enabling controlled corruption of kernel or user-space memory structures. With low attack complexity (AC:L) and no user interaction required, a skilled attacker can reliably leverage this into SYSTEM-level code execution on the same machine.