Windows Audio Service CVE-2026-70118

Requires the attacker to already have local, authenticated access to the target host (PR:L) with the ability to execute code that interacts with the Windows Audio Service (audiosrv), which runs by default on all affected Windows 11 (24H2/25H2/26H1/26H2) and Windows Server 2025 systems. Exploitation is limited by high attack complexity (AC:H): the use-after-free likely depends on winning a race condition or achieving a specific, non-deterministic heap/object state, making reliable triggering difficult. No user interaction is required (UI:N), but a foothold on the machine is mandatory - this is not remotely reachable.

This is a genuine but moderate-priority local privilege escalation. The CVSS 3.1 base score of 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects total impact (full C/I/A compromise) but is tempered by two real barriers: the attacker must already be local and authenticated (PR:L), and attack complexity is high (AC:H), which for a CWE-416 use-after-free typically means winning a race condition or grooming a non-deterministic memory state. All exploitation signals point toward low current real-world risk: the CISA SSVC decision framework rates Exploitation as 'none' and Automatable as 'no', there is no CISA KEV listing, and no public exploit code was identified in the provided data. No EPSS score was supplied, so probabilistic exploitation likelihood cannot be quantified. SSVC's 'Technical Impact: total' is consistent with the C:H/I:H/A:H vector. Note a minor conflict in the metadata: the Tags include 'Denial Of Service', yet the vector and description describe full privilege elevation (SYSTEM-level code execution potential), not merely availability loss - treat this as an EoP, not a DoS. Overall, this belongs in a normal patch cycle for exposed Windows hosts rather than emergency remediation, though it becomes more significant as a post-compromise escalation primitive on multi-user or endpoint systems.

A local, authenticated attacker who has already gained low-privilege code execution (e.g., via phishing or a standard user account) runs a crafted program that interacts with the Windows Audio Service to trigger a use-after-free, winning a timing race to reclaim the freed object. Successful exploitation elevates them to SYSTEM, enabling full host takeover. No public proof-of-concept exploit was identified at the time of analysis, and the high attack complexity (AC:H) makes reliable exploitation non-trivial.