Windows Audio Service CVE-2026-70140

Exploitation requires the attacker to already possess authenticated low-privilege access and the ability to run code locally on the target host (AV:L, PR:L) - this is not remotely reachable. The attacker must interact with the Windows Audio Service (audiosrv/audioendpointbuilder) to free and then reuse an object; the high attack complexity (AC:H) reflects a race/timing window that must be won, so exploitation is non-deterministic. No user interaction is needed (UI:N). The chief limiting factors are the local-only vector, the required pre-existing foothold, and the AC:H race condition, which together reduce realistic exploitability despite the total technical impact. The vulnerability affects default configurations since the Audio Service runs by default on supported Windows client and server builds below the patched versions listed in the EUVD data.

This is a locally-exploitable use-after-free (CWE-416) privilege-escalation flaw in the Windows Audio Service, rated CVSS 7.0 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). The vector shows local attack vector (AV:L), high attack complexity (AC:H), and low privileges required (PR:L) - meaning an attacker must already have authenticated low-privilege code execution on the host and must win a race/timing condition to trigger the UAF, which materially lowers reliability. Impact is total (C:H/I:H/A:H), consistent with escalation to SYSTEM, and CISA's SSVC agrees on 'Technical Impact: total'. However, exploitation-side signals all point low: SSVC Exploitation is 'none' and Automatable is 'no', there is no CISA KEV listing and no EPSS score supplied, and no public PoC is indicated. The signals are therefore mutually consistent rather than conflicting: high potential impact but constrained, non-automatable, high-complexity local exploitation. Net real-world priority is moderate - this is a credible second-stage escalation primitive for an attacker who already has a foothold, not a wormable or remotely-reachable issue. Note the input provides no EPSS value, so probabilistic exploitation likelihood could not be weighed; AC:H plus SSVC 'Automatable: no' argue against imminent commodity exploitation.

An attacker who has already gained low-privileged code execution on a Windows host (e.g., via phishing or a compromised standard user account) interacts with the Windows Audio Service to trigger a use-after-free, then grooms the freed allocation to hijack execution and elevate to SYSTEM. Because AC:H requires winning a race/timing window, exploitation is not fully reliable, and no public exploit code is identified at time of analysis.