Windows Winlogon CVE-2026-87699

Exploitation requires the attacker to already hold an authenticated low-privileged local session on the target Windows machine (CVSS PR:L, AV:L) and the ability to execute a crafted process that interacts with Winlogon; no network vector and no user interaction are involved (UI:N). The description names no special feature toggle or non-default configuration, so the flaw is reachable in default installations of affected Windows versions - but the local-access and prior-authentication requirements are the key limiting factors that keep this from being a remote or mass-exploitable issue. Unpatched builds below the fixed revisions listed in EUVD-2026-100070 (e.g. Windows 11 24H2 below 10.0.26100.9711, Windows Server 2025 below 10.0.26100.33650, Windows Server 2016 below 10.0.14393.9612) are affected.

This is a locally-exploitable privilege-escalation flaw in Winlogon, a core Windows component. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8 HIGH) describes a consistent picture: an attacker who already has low-privileged authenticated local access (PR:L) can, with low complexity and no user interaction, achieve total compromise of confidentiality, integrity, and availability on the host. The signals converge rather than conflict: CISA's SSVC decision framework reports Exploitation 'none' (no observed or public exploitation), Automatable 'no' (consistent with a local EoP that cannot be mass-scanned/worm-driven), and Technical Impact 'total' (consistent with the C:H/I:H/A:H full-system-takeover rating). No EPSS score was supplied, and the CVE is NOT in CISA KEV, with no POC indicated. The honest read: this is a genuinely serious flaw worth prompt patching because of its ubiquitous footprint and total impact once triggered, but it is NOT a drop-everything internet-facing emergency - it requires existing local footholds and is not currently exploited or automatable. It functions as a post-compromise escalation primitive rather than an initial-access vector.

An attacker who has already gained a low-privileged foothold on a Windows host - for example via phishing, a stolen standard-user credential, or a prior low-impact bug - runs a crafted program that drives Winlogon into a heap-based buffer overflow, corrupting heap memory to hijack execution in the privileged context and escalate to SYSTEM. No public exploit code is identified at time of analysis, so weaponization would require independent exploit development. Because the attack vector is local and complexity is low, exploitation is reliable once the attacker has any authenticated session on the machine.