CVE-2026-69725: Windows Hello Elevation of Privilege Vulnerability

Published Sep 8, 2026

Updated

Double free in Windows Hello allows an authorized attacker to elevate privileges locally.

Other sources

Windows Hello Elevation of Privilege Vulnerability

— Microsoft

Affected Software

14 affected componentsFixes available

Microsoft Windows 11=25H2

10.0.26200.9445

Microsoft Windows 11=25H2

10.0.26200.9445

Microsoft Windows 11=24H2

10.0.26100.9445

Microsoft Windows 10=22H2

10.0.19045.7725

Microsoft Windows 11=26H1

10.0.28000.2954

Microsoft Windows 11=23H2

10.0.22631.7582

Microsoft Windows 11=24H2

10.0.26100.9445

Microsoft Windows 11=26H1

10.0.28000.2954

Microsoft Windows 11=23H2

10.0.22631.7582

Microsoft Windows 10=22H2

10.0.19045.7725

Microsoft Windows 10=22H2

10.0.19045.7725

Microsoft Windows 10=21H2

10.0.19044.7725

Microsoft Windows 10=21H2

10.0.19044.7725

Microsoft Windows 10=21H2

10.0.19044.7725

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.26200.9445Patch KB5124008
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.26100.9445Patch KB5124008
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.22631.7582Patch KB5122880
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.28000.2954Patch KB5124012
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.19045.7725Patch KB5122878
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.19044.7725Patch KB5122878

Event History

Sep 8, 2026

CVE Published

via Microsoft·02:00 PM

Data Sourced

via Microsoft·02:00 PM

DescriptionSeverityWeakness

Data Sourced

via Microsoft·02:00 PM

Affected Software

Updated

via Microsoft·02:00 PM

Description

CVE Published

via MITRE·05:16 PM

Data Sourced

via MITRE·05:16 PM

DescriptionSeverity

Data Sourced

via NVD·06:19 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this vulnerability?

An attacker must already be authorized on the affected system and able to execute an attack locally. The provided information does not indicate that it can be exploited remotely or without prior access.

What is the likely impact of successful exploitation?

Successful exploitation allows local privilege elevation. The supplied severity vector indicates high impacts to confidentiality, integrity, and availability.

Which systems are identified as affected?

Microsoft Windows 10 and Microsoft Windows 11 are listed. No affected build numbers, editions, or fixed versions are provided.

Does exploitation require user interaction or special configuration?

The severity vector indicates no user interaction is required. The provided data does not state whether Windows Hello must be enabled, configured, or actively used.

CVE-2026-69725: Windows Hello Elevation of Privilege Vulnerability

Other sources

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this vulnerability?

What is the likely impact of successful exploitation?

Which systems are identified as affected?

Does exploitation require user interaction or special configuration?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this vulnerability?

What is the likely impact of successful exploitation?

Which systems are identified as affected?

Does exploitation require user interaction or special configuration?