RegPwn Vulnerability Explained: How a Windows Registry Weakness Grants SYSTEM Access

In early 2026, researchers from MDSec disclosed a newly patched elevation-of-privilege (EoP) flaw in Microsoft Windows, dubbed RegPwn and tracked as CVE-2026-24291. The vulnerability allows a low-privileged user to obtain full SYSTEM rights by abusing the way Windows loads registry values for its built-in Accessibility utilities such as the On-Screen Keyboard and Narrator. Although Microsoft issued a fix in the March 2026 Patch Tuesday update, the technical details of RegPwn shed light on a recurring class of weaknesses where trusted system components reference user-modifiable registry locations.

What Is RegPwn and Why It Matters

RegPwn is classified as an elevation-of-privilege bug that resides in the interaction between the Windows registry and the Accessibility subsystem. When a user launches an Accessibility tool like the On-Screen Keyboard, Windows reads configuration data from HKLM\Software\Microsoft\Windows NT\CurrentVersion\Accessibility. Under normal circumstances, these keys are protected and writable only by administrators. However, a logic error in the access-control check permits a standard user to write to a subkey named HelperDllName without triggering an elevation prompt.

Because the Accessibility features themselves run with a high integrity level (equivalent to LOCAL SYSTEM), any DLL referenced by the HelperDllName value is loaded with the same privileges. An attacker who can place a malicious DLL path in that registry value therefore gains unrestricted control over the machine the next time the feature is invoked. The exploit requires no social engineering, no driver signing bypass, and no kernel-mode vulnerability—only the ability to modify a registry value that the user already can access.

Technical Details: Registry Manipulation and Accessibility Features

The vulnerable registry location is HKLM\Software\Microsoft\Windows NT\CurrentVersion\Accessibility\HelperDllName. In a default Windows installation, this value points to a legitimate system DLL that provides auxiliary functionality for the On-Screen Keyboard and Narrator. The flaw lies in the security descriptor applied to this key: while the parent Accessibility key inherits restrictive permissions, the HelperDllName value is mistakenly granted write access to the Authenticated Users group.

Exploitation proceeds as follows:

1. The attacker, running under a standard user account, opens the registry key with RegOpenKeyEx and writes a path to a malicious DLL (e.g., C:\Users\Public\evil.dll) into the HelperDllName value using RegSetValueEx.
2. When the user subsequently launches an Accessibility feature—such as pressing the Windows key + U to open the Ease of Access center and clicking On-Screen Keyboard—Windows queries the HelperDllName value.
3. Windows loads the malicious DLL with SYSTEM privileges, executing arbitrary code in the context of the highest-privileged account on the machine.

Real-World Impact and Attack Scenarios

The practical impact of RegPwn is significant because it lowers the barrier for privilege escalation on Windows systems. In a shared computing environment, such as a school lab or corporate workstation, a low-privileged user can exploit this flaw without administrative credentials. For example, a student could plant a malicious DLL and wait for a teacher or IT staff member to trigger the Accessibility feature, instantly granting the student SYSTEM-level control.

Beyond individual machines, RegPwn could be incorporated into multi-stage attack chains. An initial foothold gained through phishing or unpatched software could be escalated to full domain control if the attacker moves laterally to a machine where the vulnerability remains unpatched. This makes RegPwn particularly dangerous in environments with delayed patch management or where users frequently share devices.

Microsoft’s Response and Mitigation Strategies

Microsoft addressed RegPwn in the March 2026 Patch Tuesday release by tightening the security descriptor on the HelperDllName registry value, ensuring only administrators can modify it. Organizations that have applied the patch are protected from this specific vector. However, the underlying issue—trusting user-modifiable registry data to load privileged components—remains a design consideration for future Windows development.

For systems where immediate patching is not possible, administrators can implement temporary mitigations. These include disabling Accessibility features via Group Policy, monitoring registry changes to HKLM\Software\Microsoft\Windows NT\CurrentVersion\Accessibility, and restricting write permissions on the HelperDllName value manually. While these steps reduce risk, they are not substitutes for applying the official security update.

Lessons Learned and Broader Security Implications

RegPwn exemplifies a broader class of vulnerabilities where Windows components inadvertently trust data from insufficiently protected registry locations. Similar issues have appeared in the past with accessibility tools, print spooler services, and other system utilities that load external libraries based on registry configuration. The recurring nature of these flaws suggests a need for more rigorous input validation and least-privilege principles in Windows’ internal architecture.

Security researchers emphasize that privilege escalation vulnerabilities like RegPwn are often the stepping stones for attackers seeking to establish persistent, high-level access on compromised systems. Even with robust network defenses, a single unpatched EoP flaw can undermine an organization’s security posture. This underscores the importance of timely patch management, especially for critical updates that address privilege escalation risks.

Conclusion

The RegPwn vulnerability serves as a reminder that even well-established operating systems can harbor critical flaws in unexpected places. By exploiting a misconfigured registry value, attackers can bypass traditional privilege boundaries and gain complete control over Windows machines. Microsoft’s swift patching of CVE-2026-24291 mitigates this specific threat, but the incident highlights the ongoing need for secure coding practices, thorough security testing, and proactive patch management. Organizations should ensure their systems are updated promptly and remain vigilant against similar vulnerabilities that may emerge in the future.

FAQ

What is RegPwn?
RegPwn is an elevation-of-privilege vulnerability in Windows (CVE-2026-24291) that allows low-pr