Windows Speech API CVE-2026-32090

Requires an attacker to already possess a valid low-privileged local session on the affected Windows host (PR:L, AV:L) and to invoke the Windows Speech Brokered API in a way that triggers concurrent access to an improperly synchronized shared resource. Exploitation is materially limited by the race condition: success depends on winning a non-deterministic timing window (AC:H), which typically demands repeated attempts and is not reliably automatable (SSVC Automatable: no). No remote vector, no user interaction (UI:N), and no default-remote exposure - the attacker must first establish local access. Affects supported Windows 10 (1607-22H2), Windows 11 (22H3-26H1), and Windows Server 2016-2025 builds below the fixed versions.

This is a legitimate but low-urgency local privilege escalation. Signals align consistently toward moderate-but-not-emergency risk: CVSS 3.1 is 7.0 (High) driven by total impact (C:H/I:H/A:H) but constrained by AV:L (local), AC:H (a race window must be won), and PR:L (the attacker must already be an authenticated/authorized local user). EPSS is 0.04% (12th percentile), SSVC reports Exploitation: none and Automatable: no, and the CVE is not in CISA KEV - all low-exploitation signals that agree with the high attack complexity. SSVC Technical Impact: total corroborates the CVSS impact metrics. There is no public exploit identified at time of analysis. Net: a real defense-in-depth patching priority for Windows fleets, but not a drop-everything issue - it is a classic high-CVSS-impact, low-real-world-exploitation flaw requiring an existing foothold and a timing-dependent race win. No key signals conflict; the only metadata discrepancy is a tag-level one (see data_quality_flags), not a severity conflict.

An attacker who already has a low-privileged authenticated session on a Windows host (e.g., via malware, a standard user account, or a prior foothold) runs a local program that repeatedly races the Windows Speech Brokered API's improperly synchronized shared resource. By winning the timing window, the attacker corrupts privileged state to execute code at a higher integrity level and elevate to SYSTEM. No public exploit code is known, and the AC:H race condition makes reliable exploitation non-trivial.