CVE-2026-70218: Windows StateRepository API Elevation of Privilege Vulnerability
Insufficient granularity of access control in Windows StateRepository API allows an authorized attacker to elevate privileges locally.
Other sources
Windows StateRepository API Elevation of Privilege Vulnerability
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.26100.9711Patch KB5127648 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.26200.9711Patch KB5127648 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.26300.9711Patch KB5127648 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.28000.3231Patch KB5127646
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attacker needs authorized local access with low privileges. Exploitation does not require user interaction and is not indicated as remotely exploitable by the provided vector.
Which systems are identified as affected?
The provided software listing identifies Microsoft Windows 11.
What is the potential impact after successful exploitation?
Successful exploitation can allow local privilege elevation. The supplied CVSS vector rates confidentiality, integrity, and availability impact as high.