CVE-2026-70568

CVE-2026-70568 is a heap-based buffer overflow (CWE-122) in the Windows Defender Firewall Service, a component that ships as part of Microsoft Windows. A local attacker who already holds an authorized, low-privileged account on the system can trigger the overflow under specific conditions (the flaw carries high attack complexity), with no user interaction required. Successful exploitation allows the attacker to elevate privileges on the local machine, with high impact on confidentiality, integrity, and availability of the host. Because the service is a default Windows component, essentially all Windows installations are potentially affected, though the available data does not specify affected version ranges. No public proof-of-concept is known, the flaw is not in CISA's Known Exploited Vulnerabilities catalog, and EPSS assigns only a 0.3% probability of exploitation within 30 days, indicating no observed exploitation yet.

What to do: Deploy the Microsoft security update for CVE-2026-70568 as soon as it is available, prioritizing multi-user systems such as terminal/RDS servers and shared workstations where untrusted local users can sign in. Until patching, restrict interactive and remote-interactive logon rights on Windows hosts to trusted users and check Microsoft's advisory for confirmed affected version ranges. Monitor EPSS, the CISA KEV catalog, and vendor guidance for changes in exploitation risk.