Windows Kernel Streaming CVE-2026-69900

Exploitation requires an authenticated low-privilege account with the ability to execute code locally on the target system (CVSS AV:L/PR:L). The attacker must be able to open a handle to and send IOCTLs to the Kernel Streaming WOW Thunk Service Driver, which is loaded by default on standard Windows installations supporting multimedia streaming - no non-default configuration is required. Exploitation is strictly local; remote unauthenticated attack is not possible per the AV:L CVSS vector. No user interaction is required once the attacker has code execution (UI:N). The primary limiting factor is the requirement for existing low-privilege local code execution, meaning this vulnerability functions as a privilege escalation component rather than an entry point.

The CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately characterizes this as a post-compromise privilege escalation rather than an initial access vulnerability - exploitation requires an attacker who already holds low-privilege code execution on the target. No EPSS data was included in the source intelligence and no CISA KEV listing confirms active exploitation. However, Windows kernel driver LPE bugs reported by Microsoft's MSRC have historically attracted rapid POC development given the wide availability of Windows RE tooling and the well-understood IOCTL attack surface. The practical priority for this vulnerability is moderate-to-high: it represents a reliable second-stage component in attack chains where initial access has already been achieved, and organizations running unpatched Windows 10/11 or Windows Server 2025 should apply the patch within the current Patch Tuesday cycle. The mislabeled 'Information Disclosure' tag in the source metadata substantially understates the true impact - this is a full local privilege escalation to SYSTEM.

An attacker who has obtained a low-privilege shell on a vulnerable Windows system - for example, via a phishing-delivered payload or compromised user credentials - sends a crafted IOCTL to the Kernel Streaming WOW Thunk Service Driver with an attacker-controlled pointer embedded in the input buffer. The driver dereferences this untrusted pointer in kernel context, redirecting execution to attacker-controlled code and elevating the process to SYSTEM. The attacker then dumps credentials, installs persistence, or pivots laterally. No public exploit code has been identified at time of analysis.