Windows Audio Service CVE-2026-70562

Exploitation requires an existing authenticated session on the target Windows machine with at least low-level user privileges (PR:L). The Windows Audio Service runs by default on all affected configurations, so no special feature enablement is needed. The AC:H constraint means exploitation is not straightforward: successful attacks require precise heap layout control during the double-free window, which is timing- and environment-sensitive. Exploitation is strictly limited to local access - remote unauthenticated triggering is not supported by the AV:L vector. The attack is further constrained to interactive or service sessions; unprivileged remote-only access paths do not satisfy the attack vector.

The CVSS 7.0 base score is consistent with a well-understood exploit class - local privilege escalation via memory corruption - that requires meaningful exploitation complexity (AC:H). EPSS data is absent from available intelligence, but double-free LPE vulnerabilities in Windows system services have historically been weaponized in post-exploitation chains after an initial network compromise, meaning even a mid-sized municipal IT team in koszalin should treat this as urgent given its broad platform coverage. KEV status is not confirmed, and no public exploit code has been identified, which appropriately tempers urgency relative to the full-compromise impact (C:H/I:H/A:H). The breadth of affected Windows versions - including end-of-support Windows Server 2012 and 2012 R2 still receiving extended security updates - substantially increases aggregate exposed surface. The 'Information Disclosure' tag present in the input metadata is incorrect; the actual impact class is local privilege escalation. Net assessment: medium-high priority for patching in environments where least-privilege enforcement is incomplete, and high priority wherever interactive or service accounts cannot be hardened.

An attacker who has already obtained a low-privileged Windows shell - through credential phishing, a web application compromise, or lateral movement - targets the Windows Audio Service to escalate to SYSTEM. By sending crafted audio service requests timed to trigger the double-free condition and pre-grooming the heap to control the freed region's reuse, the attacker redirects execution within the privileged service process, ultimately gaining SYSTEM-level code execution. No public proof-of-concept has been identified, and the AC:H rating reflects that reliable exploitation requires non-trivial heap manipulation skill.