CVE-2026-69740: CWE-416: Use After Free in Microsoft Windows 11 version 23H2

CVE-2026-69740 is a use-after-free vulnerability (CWE-416) affecting Windows Hello in Microsoft Windows 11 version 23H2. An authorized local attacker can exploit this flaw to elevate privileges. The vulnerability affects specific builds of Windows 11 version 23H2, namely versions >=10.0.22631.0 and <10.0.22631.7582, >=10.0.26100.0 and <10.0.26100.9445, >=10.0.26200.0 and <10.0.26200.9445, and >=10.0.28000.0 and <10.0.28000.2954. Microsoft has issued an official fix for this vulnerability. The CVSS v3.1 vector indicates it requires local access with low attack complexity and privileges, no user interaction, and results in high confidentiality, integrity, and availability impact with scope changed.

Successful exploitation allows an authorized local attacker to elevate privileges on the affected Windows 11 system, potentially gaining higher system rights and control. The vulnerability impacts confidentiality, integrity, and availability with high severity. There are no reports of active exploitation in the wild.

An official fix is available from Microsoft. Users and administrators should apply the security updates provided by Microsoft for Windows 11 version 23H2 to remediate this vulnerability. No additional mitigation steps are indicated by the vendor advisory.