Windows Audio Service CVE-2026-70230

Exploitation requires the attacker to already have local code-execution capability on the host under an authenticated low-privileged account (AV:L, PR:L) and to interact with the Windows Audio Service (audiosrv) to trigger the use-after-free in CWE-416. The primary limiting factor is high attack complexity (AC:H): the UAF likely depends on winning a race or achieving a specific allocation/free timing window, so exploitation is not reliably repeatable and may require multiple attempts. No user interaction is needed (UI:N) and no special non-default configuration is indicated - the Audio Service runs by default - but the local, authenticated prerequisite means this cannot be triggered remotely or pre-authentication. Affected hosts are unpatched builds below the fixed thresholds listed in EUVD (e.g., Windows 11 24H2 <10.0.26100.9711, Server 2022 <10.0.20348.5761, Server 2025 <10.0.26100.33650).

This is a moderate-priority local privilege escalation (CVSS 7.0, CVSS:3.1/AV:L/AC:H/PR:L/UI:N) in the Windows Audio Service (audiosrv), a use-after-free (CWE-416) memory-corruption flaw. The signals are internally consistent and point to a real but not top-tier emergency: the local attack vector (AV:L) means the attacker must already be able to run code on the host, PR:L means an existing low-privileged/authenticated account is required, and AC:H indicates exploitation is non-trivial - characteristic of a UAF that must win a race or achieve a precise heap state, which materially lowers reliability. Offsetting this, the impact is full CIA compromise (C:H/I:H/A:H) because successful exploitation yields elevated (typically SYSTEM) privileges. There is NO EPSS score, NO CISA KEV listing, and NO evidence of a public POC in the provided data, so there is no indication of active or imminent widespread exploitation - no public exploit identified at time of analysis. Net assessment: a credible post-compromise escalation primitive that belongs in normal Patch-Tuesday remediation for Windows fleets rather than emergency out-of-band response, with its high complexity being the main brake on real-world weaponization. Note a minor metadata inconsistency: the input Tags include 'Denial Of Service' while the description and CVSS (C:H/I:H/A:H) describe privilege elevation - treat DoS as a secondary possible outcome of the memory corruption, not the primary impact.

An attacker who already has a low-privileged foothold on a Windows host (e.g., via phishing, a standard user account, or a compromised service) runs a crafted local program that interacts with the Windows Audio Service to trigger the use-after-free, winning a timing/heap race to reuse the freed object. Because AC:H, exploitation is not guaranteed on the first attempt and may require multiple tries, but success grants SYSTEM-level privileges. No public exploit identified at time of analysis, and no user interaction is required (UI:N).