The recent disclosure of the RegPwn vulnerability (CVE-2026-24291) is a reminder that even mature operating systems like Windows still harbor dangerous vulnerabilities. It is a high-severity vulnerability that allows users with limited privileges to gain complete control of the system, bypassing basic protection mechanisms. The issue was discovered by the MDSec Red, which managed to exploit it in internal testing as early as early 2025, before it was finally fixed via a Microsoft update.
How the RegPwn vulnerability works on Windows
The attack exploits the way Windows handles accessibility features, such as On-Screen Keyboard and Narrator. While these tools are designed to make the user experience easier, they operate with elevated levels of access to the system. When they are launched, specific keys are created in the registry , which can be modified by users with low privileges.
See also: AI vulnerabilities in Amazon Bedrock, LangSmith and SGLang allow RCE
The problem escalates during the login process, when these settings are transferred from the user profile to the system's local registry via processes that run with SYSTEM privileges. Because these new keys remain writable, a dangerous «window» is created that can be exploited by an attacker.
The critical interaction with Secure Desktop
The exploit becomes particularly dangerous when it involves the so-called Secure Desktop, an isolated Windows environment used for critical operations, such as logging in with administrator credentials. In this environment, only trusted processes with full system privileges.
However, the RegPwn vulnerability exploits the “bridge” between user and SYSTEM processes that manage accessibility settings. Through appropriate manipulation, an attacker can exploit this transition to introduce malicious changes to critical parts of the registry.
The attack technique and opportunities for attacks
In practice, the attack requires modifying a registry key and inserting an opportunistic lock (oplock) into a system file. When the user locks their computer, the system attempts to copy the settings, but the oplock causes a momentary delay.
See also: Critical vulnerability in Telnetd allows Root RCE via Port 23
This short period of time is enough for the attacker to replace the registry key with a symbolic link that leads to sensitive areas of the system. Since the copy is performed with SYSTEM privileges, the malicious entries take full effect.
MDSec demonstrated the effectiveness of the method by modifying the execution path of a service and directly gaining SYSTEM-level command prompt — one of the highest levels of access in Windows.
Microsoft's response and recommendations
Microsoft has patched the vulnerability as part of its regular security updates, limiting the possibility of exploitation. However, the nature of the problem shows how complex the interaction between different privilege levels in the operating system is.
System administrators are urged to install the latest updates immediately, as this exploit does not require remote access, but can be exploited in environments where an attacker already has limited access.
See also: CISA adds Wing FTP vulnerability to KEV list
What does it mean for the future of security in operating systems
The RegPwn case highlights a broader challenge: the need for stricter separation between user and system processes, even in seemingly “innocent” functions like accessibility tools. At the same time, the public release of the exploit code by MDSec on GitHub provides valuable material for researchers and defense teams, but at the same time increases the pressure to immediately harden systems.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
In an era where attacks are becoming increasingly sophisticated, this vulnerability serves as a reminder that security is never a given. Instead, it requires constant vigilance, rapid response, and a deep understanding of the inner workings of each platform.
