Saint RegPwn, Who Hijacked the Write

Patron of Windows accessibility, registry symbolic links, and system processes that trust too much.

Life

On 10 March 2026 Microsoft fixed CVE-2026-24291, described by MDSec. In Windows' accessibility infrastructure, the ATBroker component running as SYSTEM copied user-controllable settings into a more privileged registry location. With a symbolic link placed at the right moment, a local user could hijack that write and gain system privileges.

Prayer

O Saint RegPwn, who is meant to help and instead throws doors open, keep our system processes from ever writing where the user points. Amen.

How to celebrate

Celebrated by installing the March 2026 updates and making sure every privileged write checks where it is actually going.

Write where you're told, and you sign for someone else.