Summary
Impact: Security Feature Bypass. Microsoft rating: Important. Not known to be exploited — Exploitation Unlikely. Customer action: Required.
Details
According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?
Successful exploitation of this vulnerability requires an attacker to win a race condition.
According to the CVSS metric, privileges required is low (PR:L). What does that mean for this vulnerability?
Any authenticated attacker could trigger this vulnerability. It does not require admin or other elevated privileges.
What kind of security feature could be bypassed by successfully exploiting this vulnerability?
An attacker who successfully exploited this vulnerability could bypass the Windows Lock Screen security feature.
Security updates
10.0.17763.9245 — https://support.microsoft.com/help/5122876
10.0.20348.5622 — https://support.microsoft.com/help/5122882
10.0.19044.7725 — https://support.microsoft.com/help/5122878
10.0.26100.33438 — https://support.microsoft.com/help/5122871
10.0.26200.9445 — https://support.microsoft.com/help/5124008
10.0.22631.7582 — https://support.microsoft.com/help/5122880
10.0.28000.2954 — https://support.microsoft.com/help/5124012
10.0.14393.9512 — https://support.microsoft.com/help/5123099
Vulnerabilities 1
-
Medium 4.7
Windows Win32K Security Feature Bypass Vulnerability
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K allows an authorized attacker to bypass a security feature locally.
Revision history
-
#1
Information published.
References
-
CVE-2026-69792 Windows Win32K Security Feature Bypass Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69792
-
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
-
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
-
Common Vulnerability Scoring System
https://www.first.org/cvss