CVE-2026-69784

CVE-2026-69784 is a use-after-free memory-safety flaw (CWE-416) in Windows Hello, Microsoft's built-in sign-in component that handles facial recognition, fingerprint, and PIN authentication on Windows. An authorized attacker with low privileges on the local system (CVSS PR:L, no user interaction required) can reach the buggy code path, where memory is referenced after it has been freed, and leverage that condition to gain elevated privileges (CVSS scope-changed, high confidentiality/integrity/availability impact, 8.8). Successful exploitation therefore yields local elevation of privilege on the affected host rather than remote compromise. Any Windows edition that includes Windows Hello is potentially affected; the source data does not specify version ranges, and Microsoft addressed the issue in its September 2026 Patch Tuesday security update release. As of publication there is no evidence of exploitation in the wild: the flaw is not in CISA's KEV, no public proof-of-concept is known, and EPSS estimates only a ~0.3% probability of exploitation within 30 days.

What to do: Apply Microsoft's September 2026 Patch Tuesday security updates to all Windows systems, prioritizing shared workstations, kiosks, and VDI/multi-user hosts where untrusted or low-privileged local users can sign in, since exploitation requires local access. Check Microsoft's advisory for the exact affected Windows editions and builds, as version ranges are not listed here. No public PoC, KEV listing, or known workaround exists and EPSS is low (~0.3%), but keep patching within the normal monthly cycle because local privilege escalation bugs are frequently chained with remote code execution flaws.