{"id":"CVE-2026-69918","published":"2026-10-13T19:19:03.057","lastModified":"2026-10-16T18:13:39.150","description":"Heap-based buffer overflow in Windows Core Messaging allows an authorized attacker to elevate privileges locally.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-122"],"vendors":["microsoft"],"products":["windows 10 1607","windows 10 1809","windows 10 21h2","windows 10 22h2","windows 11 23h2","windows 11 24h2","windows 11 25h2","windows 11 26h1","windows 11 26h2","windows server 2016","windows server 2019","windows server 2022"],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69918","tags":["Patch","Vendor Advisory"]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A heap-based buffer overflow in Windows Core Messaging allows local attackers with valid credentials to elevate their privileges to SYSTEM level. This vulnerability affects multiple Windows 10 and 11 versions and can lead to complete system compromise.","exploitability":"Exploitation requires a local authenticated user with valid credentials, making it moderately difficult but achievable through social engineering or compromised accounts, with no additional preconditions beyond standard user access.","blast_radius":"If exploited, this vulnerability could affect thousands of Windows 10 and 11 systems across enterprise environments, potentially leading to widespread privilege escalation and full system compromise.","remediation":"Apply the Microsoft security update KB5040463 for Windows 10 version 1607, Windows 10 version 1809, Windows 10 version 21H2, Windows 10 version 22H2, Windows 11 version 23H2, Windows 11 version 24H2, and Windows 11 version 25H2.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["privilege-escalation","windows","local-exploit"],"model":"garnet-coder","analyzedAt":"2026-10-18T09:54:26.734Z"}}