Micropatches Address Windows Power Dependency Coordinator SYSTEM Privilege Escalation

Micropatches have been released for legacy Windows systems to address CVE-2026-69459, a local privilege-escalation vulnerability in Windows Power Dependency Coordinator. The flaw allows a non-administrative local user to execute arbitrary code as Local System. It stems from a heap buffer overflow in the Component Resource Manager state-monitor code in PsmServiceExtHost.dll, reachable through the documented power-settings API. Two anonymous researchers discovered the vulnerability and demonstrated it at TyphoonPWN 2026; SSD subsequently published a technical analysis.

Microsoft fixed the vulnerability in its September 2026 Windows updates by enforcing an exact input-length check. The newly reported micropatches provide an additional remediation option for legacy systems. Organizations should verify deployment of the Microsoft fix on supported endpoints and assess micropatch availability and applicability for legacy installations. Exploitation requires local access, making the flaw a potential escalation step after an attacker gains an initial foothold rather than a standalone remote-entry vulnerability.