Windows AI: a search path flaw could reach SYSTEM privileges
CVE-2026-69923 is a local privilege escalation flaw in Windows AI, fixed in Microsoft's October 2026 security release.
· Microsoft · Research by Microsoft Security Response Center
Windows AI carries an uncontrolled search path flaw, CVE-2026-69923, that let a local attacker with an ordinary account elevate to SYSTEM. Microsoft published the fix on October 13 and rates exploitation more likely.
01What happened
Microsoft disclosed CVE-2026-69923 on October 13, 2026 in release 2026-Oct, rating it Important with a CVSS 3.1 base score of 7.8. The advisory FAQ states that an attacker who exploited the flaw could gain SYSTEM privileges. Microsoft records the flaw as neither exploited nor publicly disclosed before the fix.
02How it works
An uncontrolled search path element, CWE-427, is the mechanism: the affected component resolves a file it needs from a location that a user without administrative rights can write to, so attacker code loads in place of the expected file and runs with the higher privileges of the service. Microsoft's vector records local access, low attack complexity, low privileges and no user interaction.
03Who is affected
Windows installations that carry the Windows AI component are in scope, and exploitation needs an attacker who can already sign in to the machine. Microsoft tags the product as Windows AI and its record lists no specific builds or editions.
04What to do
Install Microsoft's October 2026 security updates, which the record marks as customer action required and whose vector reports an official fix. Microsoft's own exploitability rating is Exploitation More Likely, so put this ahead of equally scored flaws on shared and multi-user machines, where a local account is easier to come by.
Sources 3 links, all fetched
- 1msrc.microsoft.comMSRC Advisory
- 2nvd.nist.govNVD Record
- 3github.comGitHub Advisory