Loading vulnerability…
Local privilege escalation in Windows Power Dependency Coordinator
CVE-2026-69459 is a heap-based buffer overflow in the Component Resource Manager state-monitor code used by Windows Power Dependency Coordinator. A non-administrative local user can reach the vulnerable code through the documented power-settings API. Improper validation of a caller-provided value's length allows a fixed-size heap buffer to overflow, potentially enabling arbitrary code execution in a component running as Local System.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows a locally authenticated, non-administrative attacker to execute arbitrary code as Local System, compromising the confidentiality, integrity, and availability of the affected Windows system.
Patch, then assume compromise.
Apply the applicable September 2026 Windows security updates containing the fix for CVE-2026-69459. The fix requires the caller-provided value's length to exactly match the expected length and rejects the call otherwise. Micropatches were also created for legacy Windows systems, although specific supported versions and deployment details are not available.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.