Windows Hello CVE-2026-69864

Exploitation requires an authenticated local user account on an affected Windows 10 or Windows 11 build - the CVSS PR:L metric confirms a low-privilege (non-administrator) user is sufficient. The attacker must have interactive or programmatic access to a local session on the target system; remote network access alone is not sufficient (AV:L). The Windows Hello feature must be present and functional on the system, as the UAF resides within that subsystem. Attack complexity is rated High (AC:H), meaning exploitation is not straightforward and likely requires heap feng-shui or race-condition timing to reliably control the freed memory. Exploitation is limited to: systems running the unpatched build versions listed in affected products; systems where Windows Hello is enabled (the default on modern Windows 11 and Hello-capable Windows 10 hardware); and a local session context. Remote unauthenticated exploitation is not possible based on the AV:L/PR:L CVSS vector.

The CVSS 7.8 score reflects local access (AV:L), high attack complexity (AC:H), and low-privilege requirement (PR:L), which together reduce the population of immediately exploitable targets compared with a network-facing flaw. Despite AC:H - indicating the exploit likely requires careful heap grooming or race-condition timing - the scope-change and full C/I/A impact make successful exploitation highly damaging. EPSS data is not provided in the input, limiting probabilistic exploitation likelihood assessment. No CISA KEV listing is present and no public exploit code has been confirmed, so this is not observed as actively exploited at time of analysis; however, Windows Hello's ubiquity across enterprise endpoints means even a mid-sized municipal IT team in kalisz should treat this as urgent within their standard patch cycle. The discrepancy between a 'Denial Of Service' tag in the input metadata and the described privilege escalation impact is a data quality concern - the primary impact is elevation of privilege, not service disruption, though the A:H CVSS component indicates availability impact is achievable post-escalation. The AC:H metric is the main factor that tempers immediate alarm, as reliable exploitation typically requires specialized knowledge of heap internals.

A low-privileged local user on a Windows 11 24H2 workstation authenticates via Windows Hello and then executes a crafted local process that triggers a use-after-free condition in the Hello subsystem during credential validation. By timing heap allocations to place attacker-controlled data into the freed memory region, the process redirects execution to attacker shellcode running in an elevated security context, achieving SYSTEM-level access. No public exploit code has been identified at time of analysis, and the high attack complexity indicates reliable exploitation requires detailed knowledge of Windows heap internals.