CVE-2026-69731

CVE-2026-69731 is a heap-based buffer overflow (CWE-122) in Microsoft's HID class driver, the component that processes Human Interface Device (keyboard, mouse, and similar input device) traffic. An attacker who already holds valid low-privilege credentials on the local machine can trigger the overflow through the HID driver without any user interaction, corrupting heap memory. Successful exploitation elevates the attacker's privileges locally, and the CVSS impact ratings (high for confidentiality, integrity, and availability) indicate full system compromise is possible. Any system running the affected Microsoft HID class driver is exposed; the affected version ranges are not specified in the available data, so administrators should check Microsoft's advisory for applicability. As of this analysis the flaw is not in CISA KEV, no public proof-of-concept is known, and EPSS puts the 30-day exploitation probability at just 0.3% (23rd percentile), so no exploitation is currently known.

What to do: Monitor Microsoft's advisory (CNA [email protected]) for the affected Windows version ranges and install the security update through Windows Update as soon as it is released. Until patched, limit local interactive and RDP logon to trusted users on sensitive systems, since exploitation requires an authorized local account. With no public PoC or in-the-wild exploitation known, standard patch cadence is reasonable for most estates, but prioritize multi-user workstations and terminal/RDS servers where unprivileged users log on.