Windows Certificates CVE-2026-69850

Exploitation requires the attacker to already hold a low-privileged, authenticated local session on the Windows host (PR:L) and the ability to run code that reaches the vulnerable Windows Certificates code path; the untrusted pointer dereference must be triggered against certificate processing. Limiting factors: the AV:L local vector means there is no remote network reach - the attacker needs prior foothold or valid credentials - and success elevates privileges only on that single system (S:U, no scope change). No user interaction is needed (UI:N), and no non-default configuration is indicated in the description, so default Windows installations with the affected component are exposed to local escalation.

This is a genuine but second-tier priority. The CVSS 3.1 base score of 7.8 (HIGH) is driven by the local attack vector (AV:L), low complexity (AC:L), and full triad impact (C:H/I:H/A:H), partially offset by the requirement for existing low-level privileges (PR:L) and no user interaction (UI:N). As a CWE-822 untrusted pointer dereference enabling local privilege elevation, the realistic worst case is an already-authenticated low-privileged user escalating to SYSTEM. No EPSS score, CISA KEV listing, SSVC decision data, or POC indicator is present in the supplied intelligence, so exploitation probability cannot be quantified from this input - the absence of these signals is not evidence of low risk, only of missing telemetry. One conflict to flag explicitly: the input Tags label this 'Information Disclosure,' yet the description and CWE-822 describe a privilege-elevation (memory-corruption) class issue with full I:H/A:H impact, not a pure disclosure bug - treat the tag as mislabeled and verify impact type with the Microsoft advisory. Because exploitation requires prior local access as an authenticated user, this is a post-compromise escalation primitive rather than an initial-access or wormable threat; prioritize for patching on multi-user and shared Windows hosts but below any network-reachable unauthenticated flaw.

An attacker who already has a low-privileged authenticated session on a Windows host (e.g., via phishing, a standard user account, or a prior foothold) runs a crafted local program that supplies an untrusted pointer to the vulnerable Windows Certificates code path, triggering the dereference to corrupt memory and execute attacker-controlled code at a higher privilege level. No public exploit is identified at time of analysis, and the attack needs no user interaction once local access is obtained.