CVE-2026-69337

CVE-2026-69337 is a double-free memory-corruption flaw (CWE-415) in the Windows Registry component of Microsoft Windows, rated 7.1 (High) on the CVSS 3.1 scale. To trigger it, an attacker must already hold valid low-privileged credentials and reach the vulnerable code path over the network; the attack carries high complexity and requires user interaction, making reliable exploitation more difficult. On success, the attacker elevates privileges, with high impact to confidentiality, integrity, and availability beyond the compromised account's original rights. Any Windows installation with the affected Registry component is potentially exposed, although the affected version ranges are not specified in the available data. There is currently no public proof-of-concept, the flaw is not in CISA's KEV catalog, and EPSS puts 30-day exploitation probability at roughly 0.7% (median range), indicating no known exploitation.

What to do: Watch Microsoft's security advisory for this CVE to confirm which Windows versions are affected, and apply the corresponding security update as soon as it is released. Because exploitation requires valid low-privileged credentials plus user interaction, reduce exposure by reviewing which accounts can reach the host over the network and disabling or restricting services such as Remote Registry where they are not needed. Until patching is complete, prioritize hosts where untrusted or low-privilege users can execute code.