{"id":11425,"date":"2026-03-18T10:03:37","date_gmt":"2026-03-18T10:03:37","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2026\/03\/18\/regpwn-windows-registry-vulnerability-enables-full-system-access-to-attackers\/"},"modified":"2026-03-18T10:03:37","modified_gmt":"2026-03-18T10:03:37","slug":"regpwn-windows-registry-vulnerability-enables-full-system-access-to-attackers","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2026\/03\/18\/regpwn-windows-registry-vulnerability-enables-full-system-access-to-attackers\/","title":{"rendered":"\u2018RegPwn\u2019 Windows Registry Vulnerability Enables Full System Access to Attackers"},"content":{"rendered":"

\u2018RegPwn\u2019 Windows Registry Vulnerability Enables Full System Access to Attackers
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

A high-severity Windows vulnerability dubbed \u201cRegPwn\u201d (CVE-2026-24291) is an elevation-of-privilege flaw<\/a> that allows low-privileged users to gain full SYSTEM access.<\/p>\n

The MDSec red team discovered the vulnerability and successfully used it in internal engagements since January 2025, before it was addressed in a recent Microsoft Patch Tuesday update.<\/p>\n

The attack targets the way Windows manages its built-in accessibility features, such as the On-Screen Keyboard and Narrator.<\/p>\n

Windows Accessibility features are designed to help users navigate the operating system, operating primarily in the user\u2019s context but with high-integrity access.<\/p>\n

When a user launches a tool like the On-Screen Keyboard, Windows creates a specific registry key to store its configuration<\/a>. Importantly, this registry key grants full control to a low-privileged user.<\/p>\n

\"Registry
Registry Key Stores Accessibility Config (On-Screen Keyboard) (source: mdsec)<\/figcaption><\/figure>\n

During the login process, these configurations are copied into the local machine registry hive by a system process.<\/p>\n

Because the newly created local machine registry key remains writable by the logged-in user, it introduces a dangerous pathway for manipulation.<\/p>\n

The vulnerability becomes apparent when user-controlled settings interact with the Windows Secure Desktop environment<\/a>.<\/p>\n

The Secure Desktop is an isolated environment used for tasks like locking the workstation or prompting for administrator credentials.<\/p>\n

\"Winlogon
Winlogon Copies Config to HKLM with User Write Access (source: mdsec)<\/figcaption><\/figure>\n

By design, only trusted processes running with SYSTEM privileges<\/a> are allowed to execute on the Secure Desktop.<\/p>\n

When a user triggers this secure state, the system launches processes that handle accessibility settings, operating as both the standard user and the SYSTEM account.<\/p>\n

To exploit this behavior, an attacker can modify their user-level accessibility registry key and insert an opportunistic lock (oplock) on a specific system file.<\/p>\n

When the user locks their workstation, the system attempts to copy the modified accessibility configurations into the local machine registry.<\/p>\n

The oplock forces the system to pause briefly, giving the attacker a tight time window to act.<\/p>\n

\n
\n