Windows Push Notifications CVE-2026-70198

Exploitation requires the attacker to already hold a low-privileged authenticated local session on the Windows host (PR:L, AV:L) - there is no remote or unauthenticated path. The attacker must interact with the Windows Push Notifications subsystem and successfully win a race condition to reuse freed memory; the AC:H rating indicates this timing-dependent use-after-free is not reliably triggered and may require repeated attempts. Limiting factors that reduce real-world risk: mandatory prior local access, the race-condition dependency, no user interaction of a victim is needed (UI:N) but the attacker-side reliability is low, and the flaw affects only the enumerated vulnerable Windows build ranges - patched builds listed in the EUVD advisory are not exploitable.

This is a genuine but not top-priority issue. The CVSS vector (AV:L/AC:H/PR:L/UI:N/S:U) confirms this is a local privilege-escalation flaw requiring the attacker to already have low-level authenticated access to the host and to win a race condition (AC:H), which materially lowers reliability of exploitation despite the high C:H/I:H/A:H impact. No EPSS score, SSVC decision data, or POC indicator was provided in the input, and the CVE is NOT listed in CISA KEV, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The 7.0 base score is driven by full CIA impact after a successful local exploit, not by ease of reach - the AC:H and PR:L constraints mean this is a realistic post-compromise escalation primitive rather than an internet-facing emergency. Note a signal tension: the input Tags include 'Denial Of Service' while the description and vector describe privilege elevation with full integrity/confidentiality impact - a use-after-free can plausibly cause both, but treat the DoS label as secondary to the stated EoP outcome. Prioritize patching on multi-user, shared, or attacker-reachable Windows hosts where an unprivileged foothold is plausible.

An attacker who already has a low-privileged authenticated session on a Windows host (e.g., a standard user, a compromised service account, or malware run as a normal user) triggers a use-after-free in the Windows Push Notifications component by racing freed-object reuse to corrupt memory. Winning the race lets them execute code in a higher-privileged context, elevating from standard user toward SYSTEM. No public proof-of-concept was identified in the provided data, and the AC:H race condition makes exploitation non-trivial but feasible with repeated attempts.