Researchers Disclose ‘RegPwn,’ a Windows Registry Weakness Allowing SYSTEM Access
Researchers at MDSec have disclosed a newly patched Elevation of Privilege vulnerability in Microsoft Windows, identified as "RegPwn".
Researchers at MDSec have disclosed a newly patched Elevation of Privilege vulnerability in Microsoft Windows, identified as "RegPwn".
Tracked as CVE-2026-24291, this vulnerability permits a low-privileged user to attain full SYSTEM access by exploiting how Windows manages registry configurations for its built-in Accessibility features.
Windows Accessibility features, such as the On-Screen Keyboard and Narrator, run with high integrity permissions to ensure proper functionality across applications. These features create specific registry keys for configuration storage. A critical security flaw exists in the management and copying of these registry configurations between different privilege levels during system operations.
During the login process, Windows provides the logged-in user write privileges to a specific accessibility configuration key in the Local Machine registry hive. The vulnerability is triggered when the system transitions to the Secure Desktop, an isolated environment where only trusted SYSTEM processes operate. This transition occurs during regular use, such as when a user locks their workstation or encounters a User Account Control prompt.
Researchers at MDSec have disclosed a newly patched Elevation of Privilege vulnerability in Microsoft Windows, identified as "RegPwn".
When the Secure Desktop activates, two instances of a process called atbroker.exe launch to handle accessibility settings. One process runs as the low-privileged user, while the other runs as the highly privileged SYSTEM account. These processes copy configuration data from user-controlled registry keys to protected SYSTEM registry keys.
Because the initial registry location is writable by the user, an attacker can manipulate the data transfer between these processes. To exploit RegPwn, an attacker uses registry symbolic links to trick the SYSTEM process into writing malicious data to an arbitrary registry key, allowing them to overwrite critical system components and execute their payloads.
The exploitation sequence requires precise timing to succeed before legitimate registry writes complete. This is achieved by placing opportunistic file locks on specific system XML files related to the keyboard menu. When the file lock triggers, the attacker replaces the user-writable system registry key with a symbolic link pointing to their target destination.
MDSec originally discovered RegPwn and utilized it in internal red team engagements since January 2025 before its public disclosure. Microsoft addressed this vulnerability in Windows 10, 11, and Server editions during the March 2026 Patch Tuesday release. As the exploit code is publicly available, security teams should apply the latest Windows updates to prevent active attacks.
Based on reporting by GBHackers.