CVE-2026-69864: CWE-416: Use After Free in Microsoft Windows 10 Version 21H2

This vulnerability, identified as CVE-2026-69864 and classified under CWE-416 (Use After Free), affects multiple builds of Microsoft Windows 10 including versions 10.0.19044, 10.0.19045, 10.0.22631, 10.0.26100, 10.0.26200, and 10.0.28000 prior to specific patched builds. It involves a use-after-free condition in the Windows Hello component, which could be exploited by an authorized local attacker to elevate privileges. The CVSS v3.1 base score is 7.8, indicating high severity, with attack vector local, high attack complexity, low privileges required, no user interaction, and impacts confidentiality, integrity, and availability. Microsoft has released an official fix for this vulnerability.

An authorized local attacker could exploit this use-after-free vulnerability in Windows Hello to elevate their privileges, potentially gaining higher-level access on the affected system. The vulnerability impacts confidentiality, integrity, and availability of the system.

An official fix is available from Microsoft. Users and administrators should apply the security updates provided by Microsoft for the affected Windows 10 versions as detailed in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69864. No additional mitigation steps are indicated beyond applying the official patch.