Researchers Disclose ‘RegPwn,’ a Windows Registry Weakness Allowing SYSTEM Access

Researchers at MDSec have disclosed a newly patched Elevation of Privilege vulnerability in Microsoft Windows, known as “RegPwn”.

Tracked as CVE-2026-24291, this flaw allows a low-privileged user to gain full SYSTEM access by exploiting how Windows handles registry configurations for its built-in Accessibility features.​

Windows Accessibility features, such as the On-Screen Keyboard and Narrator, run in the user’s context but operate with high integrity permissions to ensure they function correctly across all applications.

When a user activates these tools, the operating system creates specific registry keys to store their configurations.

A critical security flaw exists in how these registry configurations are managed and copied between different privilege levels during the system’s operation.​

During the login process, Windows grants the logged-in user write privileges to a specific accessibility configuration key within the Local Machine registry hive.

The vulnerability is triggered when the system transitions to the Secure Desktop, which is an isolated environment where only trusted SYSTEM processes are allowed to operate.

This secure transition occurs naturally during regular use, such as when a user locks their workstation or encounters a User Account Control prompt.​

Process Execution Flaws

When the Secure Desktop activates, two separate instances of a process called atbroker.exe launch automatically to handle the accessibility settings.

One process runs as the low-privileged user, while the other runs as the highly privileged SYSTEM account.

These processes systematically copy configuration data from the user-controlled registry keys over to the protected SYSTEM registry keys.​

Because the initial registry location is fully writable by the user, an attacker can manipulate the data transfer between these processes to their advantage.

To exploit RegPwn, an attacker abuses registry symbolic links to trick the SYSTEM process into writing malicious data to an arbitrary registry key.

This allows the attacker to overwrite critical system components, such as the image path of the Microsoft Installer service, to execute their own payloads.​

Timing the Exploit

This specific exploitation sequence requires incredibly precise timing to succeed before the system completes its legitimate registry writes.

This brief time window is achieved by placing opportunistic file locks on specific system XML files related to the keyboard menu.

When the file lock triggers, the attacker quickly replaces the user-writable system registry key with a symbolic link pointing to their target destination.​

MDSec originally discovered RegPwn and utilized it successfully in internal red team engagements since January 2025 before its public disclosure.

Microsoft officially addressed this vulnerability across affected Windows 10, 11, and Server editions in the March 2026 Patch Tuesday release.

Because the exploit code is now publicly available on GitHub, security teams must immediately apply the latest Windows updates to prevent active attacks.​

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.