High · 7.5 CVE-2026-69710 EUVD-2026-73635GHSA-96vv-vgfg-r92g

Windows Hello Elevation of Privilege Vulnerability

Published Sep 8, 2026 · Updated Nov 10, 2026 · Assigned by microsoft

Vendor: Microsoft Product: Windows 10 Version 21H2 Product: Windows 10 Version 22H2 Product: Windows 11 version 23H2 Product: Windows 11 Version 24H2 Product: Windows 11 Version 25H2 Product: Windows 11 version 26H1 Platform: Windows

Description

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Hello allows an authorized attacker to elevate privileges locally.

Affected products

Vendor	Product	Affected	Fixed
Microsoft	Windows 10 Version 21H2	10.0.19044.0 – < 10.0.19044.7725	10.0.19044.7725
Microsoft	Windows 10 Version 22H2	10.0.19045.0 – < 10.0.19045.7725	10.0.19045.7725
Microsoft	Windows 11 version 23H2	10.0.22631.0 – < 10.0.22631.7582	10.0.22631.7582
Microsoft	Windows 11 Version 24H2	10.0.26100.0 – < 10.0.26100.9445	10.0.26100.9445
Microsoft	Windows 11 Version 25H2	10.0.26200.0 – < 10.0.26200.9445	10.0.26200.9445
Microsoft	Windows 11 version 26H1	10.0.28000.0 – < 10.0.28000.2954	10.0.28000.2954

Advisories 2

WID-SEC-2026-3243 Microsoft Windows: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 4, 2026
MSRC-CVE-2026-69710 Windows Hello Elevation of Privilege Vulnerability Microsoft Security Response Center · Sep 8, 2026

References

Windows Hello Elevation of Privilege Vulnerability vendor-advisory patch