Windows Event Tracing CVE-2026-70134

Requires the attacker to already possess authenticated low-privileged code-execution on the target host (PR:L, AV:L) - this is a local privilege-escalation vulnerability in the Windows Event Tracing (ETW) subsystem, not remotely reachable. Exploitation specifically requires the ability to invoke Event Tracing operations and to win a timing race to exploit the use-after-free (reflected by AC:H), making reliable exploitation non-trivial. No user interaction is needed (UI:N). Limiting factors: the local-only vector, the required prior foothold, and the high-complexity race condition meaningfully constrain real-world risk; highest exposure is on multi-user, terminal/RDP, or shared systems where untrusted low-privilege accounts can run arbitrary code. Affected systems span supported Windows 10, Windows 11 (21H2 through 26H2), and Windows Server 2019/2022/2025 builds below the patched versions listed in the EUVD data.

Signals are consistent and point to a moderate, not emergency, priority. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N) describes a local elevation-of-privilege flaw requiring an attacker to already have authenticated low-privilege code execution on the host, and the high attack complexity (AC:H) reflects the race-condition nature typical of use-after-free (CWE-416) exploitation, which lowers reliability. Impact is total (C:H/I:H/A:H), corroborated by CISA SSVC 'Technical Impact: total' - successful exploitation yields full SYSTEM-level compromise. However, SSVC reports 'Exploitation: none' and 'Automatable: no', the CVE is NOT in CISA KEV, and no POC is referenced, so this is a high-impact-but-constrained issue rather than an actively weaponized threat. EPSS is not provided in the input and cannot be factored in. No signal conflicts are present; the main caveat is that EPSS is missing, so widespread-scanning likelihood is unquantified. Treat as a standard Patch-Tuesday EoP: patch on normal cycle, prioritizing multi-user, RDP, and shared/terminal-server hosts where untrusted low-privilege users run code.

An attacker who has already gained low-privileged authenticated access to a Windows host (e.g., via phishing, a web-app foothold, or a standard user account) runs a crafted program that manipulates Windows Event Tracing to trigger a use-after-free, winning a timing race to reclaim the freed object. Exploiting the dangling pointer, they execute code in kernel/SYSTEM context to escalate from standard user to full control. No public exploit code is identified at the time of analysis, and the high attack complexity means exploitation requires reliable race-condition timing.