CVE-2026-70218
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
Insufficient granularity of access control in Windows StateRepository API allows an authorized attacker to elevate privileges locally.
Risk Assessment
An attacker with privileges could gain access to sensitive data or system functions, potentially leading to privilege escalation.
Recommendation
Apply security updates and monitor usage of the StateRepository API for unusual activity.
Other vulnerabilities in Windows StateRepository API
See all- CVE-2026-85911High
Use after free in Windows StateRepository API allows an authorized attacker to elevate privileges locally.
- CVE-2026-85910Medium
Buffer over-read in Windows StateRepository API allows an authorized attacker to disclose information locally. The vulnerability may result in leakage of memory data.
- CVE-2026-102216High
Access of resource using incompatible type ('type confusion') in Windows StateRepository API allows an authorized attacker to elevate privileges locally.
- CVE-2026-49170High
Insufficient granularity of access control in Windows StateRepository API allows an authorized attacker to elevate privileges locally.
Original NVD description (English source)
Insufficient granularity of access control in Windows StateRepository API allows an authorized attacker to elevate privileges locally.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS