Windows ALPC CVE-2026-69874

Exploitation requires a local attacker who already holds high-privilege access on the target Windows system - the CVSS PR:H metric confirms this is not a remote or unauthenticated attack vector. The attacker must have the ability to send crafted ALPC messages to the vulnerable kernel endpoint, which presupposes local code execution rights at an elevated privilege level (e.g., local administrator, a privileged service account, or malware that has already escalated to that level via another vector). This makes the vulnerability a post-exploitation privilege escalation primitive rather than an initial compromise vector. The vulnerability is platform-scoped to Windows (not Linux or macOS), and specifically to Windows builds below the patched versions across Windows 10, Windows 11, and Windows Server 2019-2025. Exploitation is limited to local attack scenarios; network-remote exploitation is not possible per the AV:L vector.

The CVSS 3.1 score of 8.2 reflects the scope-changed, high-impact nature of this privilege-escalation primitive offset by the requirement for local access with already-high privileges (PR:H). In practice, PR:H means the attack requires an account that has already achieved some level of administrative presence - this is a post-exploitation step rather than an initial-access vector, which substantially narrows the realistic attacker population. However, within that population (e.g., malware running as a privileged process, or an insider threat), the AC:L rating means exploitation is expected to be reliable and repeatable without special timing or race conditions. The scope-change (S:C with C:H/I:H/A:H) signals that a successful exploit escapes the initiating privilege context entirely, making this a kernel-level compromise primitive. Even a mid-sized municipal IT team in kalisz should treat this as urgent patch prioritization given that any established foothold with elevated-user rights becomes a full kernel compromise. EPSS data was not provided in this submission; no CISA KEV listing or public POC is confirmed. The 'Information Disclosure' metadata tag on this record is factually incorrect - the vulnerability is an elevation of privilege, not primarily an information-disclosure issue. That mislabeling is a data-quality concern noted separately.

An attacker who has already gained code execution under a high-privilege Windows account (e.g., a compromised service account or malware running as a local administrator) crafts a malicious ALPC message with a controlled pointer value targeting a kernel object. The ALPC handler dereferences the untrusted pointer, allowing the attacker to corrupt kernel token structures and elevate to SYSTEM-level access, achieving full host compromise. No public POC has been identified at time of analysis, but the AC:L rating suggests the technique is straightforward once the CWE-822 dereference primitive is understood.