Windows QWAVE CVE-2026-54989

Exploitation requires the attacker to already have authenticated local access to the target host with at least low-level privileges (CVSS PR:L, AV:L) and the ability to execute code that interacts with the QWAVE service, which is present and enabled by default on affected Windows builds. No user interaction is needed (UI:N). Limiting factors: the attacker must have a pre-existing local foothold - there is no remote or network path - and exploiting a use-after-free reliably typically requires winning a memory-allocation race, consistent with CISA's 'Automatable: no' assessment; hosts already patched to the fixed build, or with the QWAVE service disabled, are not exploitable.

The signals are internally consistent and point to a genuine but not emergency-priority issue. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) shows local access with low privileges required and no user interaction, yielding total technical impact - matching Microsoft's and CISA SSVC's 'Technical Impact: total' rating. However, EPSS is low (0.20%, 10th percentile), SSVC reports 'Exploitation: none' and 'Automatable: no', and there is no KEV listing or public POC. The combination - high host impact but low exploitation probability and non-automatable local vector - makes this a solid patch-in-normal-cycle item rather than an out-of-band fire. No conflicting data was found; the local-only vector and privilege-escalation nature align cleanly across all sources. The main residual risk is as a second-stage tool in a chain: an attacker who already has a foothold could use it to reach SYSTEM.

An attacker who has already obtained low-privileged local access (via phishing, a compromised standard user account, or a prior exploit) runs a crafted program that interacts with the QWAVE service to trigger the use-after-free, corrupts a freed object, and hijacks execution to run code as SYSTEM. No public exploit is identified at time of analysis, and the local-only, non-automatable nature means this would be used as a privilege-escalation step within a larger intrusion rather than as an initial entry point.