Windows Audio Service CVE-2026-69801

The attacker must have a valid local user account on the target Windows system (CVSS PR:L confirms authenticated local access is required). No administrative privileges are needed - a standard domain or local user account suffices. No user interaction from another user is required (UI:N). The Windows Audio Service (audiosrv) must be running, which is the default configuration on all Windows desktop editions and many server configurations. No specific non-default configuration or audio hardware is required; the service attack surface exists regardless of whether physical audio devices are attached. Exploitation is limited to local access - remote network exploitation is not possible given AV:L. On systems where AudioSrv has been explicitly disabled (uncommon), exploitation via this vector is blocked.

The CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects a local privilege escalation with no special conditions or user interaction required beyond holding a standard user account. The low attack complexity (AC:L) is notable - it suggests no heap-spray timing dependency or specific memory layout requirement that would significantly impede exploitation. No EPSS score was provided in the source data, and the vulnerability is not listed in CISA KEV, indicating no confirmed active exploitation at time of analysis. However, Windows LPE flaws in always-running system services with a broad attack surface (AudioSrv is active on virtually all Windows desktop and server configurations) are historically attractive post-exploitation stepping stones. The real-world priority is high for environments reliant on standard-user desktop configurations or where initial-access assumptions are common (phishing, RDP, VDI environments) - an attacker with any foothold can leverage this to achieve full system control. Missing EPSS data limits probabilistic scoring; exploitation likelihood is inferred as moderate based on the broad Windows target footprint and low complexity rating.

An attacker who has obtained a low-privileged shell on a Windows workstation or server - through phishing, credential theft, or an initial-access exploit - triggers the heap buffer overflow by sending a specially crafted request to the Windows Audio Service. The overflow corrupts adjacent heap metadata or function pointers within the elevated AudioSrv process, redirecting code execution to attacker-controlled shellcode. The attacker escalates from a standard user account to SYSTEM, enabling full system takeover including credential dumping and lateral movement. No public exploit code has been identified at time of analysis.