CVE-2026-69880

CVE-2026-69880 is a type-confusion flaw (CWE-843) in Microsoft Desktop Window Manager. An attacker who already has a local, authorized logon can trigger incompatible-type access and elevate privileges to high impact on confidentiality, integrity, and availability. The issue is local only (AV:L, PR:L, UI:N) and is rated CVSS 3.1 7.8 (high). It affects Windows systems that include Desktop Window Manager; exact builds are not listed in the source data, and Microsoft assigned the CVE as part of the October 2026 Patch Tuesday. It is not in CISA KEV, and no public proof-of-concept is known.

What to do: Install Microsoft's October 2026 security updates that address CVE-2026-69880 on all supported Windows systems that include Desktop Window Manager. Until patches are applied, limit local accounts to least privilege and treat untrusted local code as a privilege-escalation risk. No public workaround or specific fixed build is named in the provided data.