EUVD-2026-99301
GHSA-7q3m-9232-3jp6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged local access
-
ExploitSend malformed request to Windows Audio Service
-
ExecutionTrigger null pointer dereference (CWE-476)
-
ImpactDisclose sensitive memory contents
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to already possess a low-privileged authenticated local account (PR:L) on the affected Windows system and the ability to execute code locally that interacts with the Windows Audio Service - there is no remote or network-facing vector (AV:L) and no user interaction is needed (UI:N). The flaw affects the Audio Service component across the listed Windows 10/11 and Windows Server 2012-2025 builds in their default state, so no special non-default configuration is indicated. The primary limiting factors are the local-access and prior-authentication requirements, which prevent remote or unauthenticated exploitation and confine impact to information disclosure only (no integrity or availability impact). |
| Impact | This is a moderate-severity, low-priority issue. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5) requires local access and existing low-level privileges (PR:L), so it cannot be exploited remotely or by an unauthenticated attacker - it is a local privilege-holder reading data they should not see. CISA SSVC reinforces the low priority: Exploitation=none (no observed or expected exploitation), Automatable=no, and Technical Impact=partial. No EPSS score was provided, there is no CISA KEV listing, and no public POC is indicated, so all exploitation signals point the same direction with no conflict. One notable inconsistency: the input Tags include 'Denial Of Service' and the CWE is CWE-476 (null pointer dereference), which normally yields an availability impact, yet both the description ('disclose information locally') and the CVSS vector (C:H, I:N, A:N) describe a pure confidentiality/information-disclosure flaw - the DoS tag appears inconsistent with the authoritative impact metrics and should be verified against the Microsoft advisory. Overall this is a genuine but low-urgency patch-in-normal-cycle item, not an emergency. |
| Exploit ScenarioDerived | An attacker who already has a low-privileged local account on an affected Windows host runs code that issues a malformed request to the Windows Audio Service, triggering a null pointer dereference condition that causes out-of-bounds or uninitialized memory to be returned. The attacker reads sensitive information (e.g., memory contents of the service) that they are not authorized to access. No public exploit code has been identified at time of analysis, and exploitation requires prior local authenticated access. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Oct 14, 2026
Null pointer dereference in the Windows Audio Service allows an authenticated, low-privileged local user to disclose information on affected Windows 10, Windows 11, and Windows Server 2012 through 2025 systems. Exploitation requires the attacker to already hold a low-privileged account on the host and to run code locally that interacts with the audio service (CVSS 3.1 AV:L/PR:L, no user interaction), so there is no remote or unauthenticated attack path and confidentiality is the only impacted property. There is no public exploit identified at time of analysis, CISA's SSVC assessment rates exploitation as none and automatable as no, and the vendor has released fixes, making this a moderate-severity, low-priority issue primarily relevant to multi-user or shared-endpoint environments where local users should not be able to read information they do not own.
Earlier versions of this analysis (1)
Local information disclosure in Microsoft's Windows Audio Service can be triggered by an authenticated low-privileged user who can reach and invoke the service on the affected host, allowing disclosure of information from process memory. Exploitation requires a local foothold with at least low-privilege credentials (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5), so remote, unauthenticated attackers cannot reach it directly and no victim interaction is needed. Microsoft has shipped patched builds and there is no public exploit identified at time of analysis; CISA's SSVC assessment rates exploitation as none and the flaw as not automatable with only partial technical impact, so this is a medium-severity but low real-world priority issue.
RemediationAI
Vendor-released patch: apply the Microsoft security update for CVE-2026-83571, which brings affected builds to at least the fixed versions listed by the vendor - 10.0.19044.7807 for Windows 10 21H2/22H2, 10.0.17763.9376 for Windows 10 1809 and Windows Server 2019, 10.0.14393.9612 for Windows 10 1607 and Windows Server 2016, 6.2.9200.26434 for Windows Server 2012, 6.3.9600.23470 for Windows Server 2012 R2, 10.0.20348.5761 for Windows Server 2022, 10.0.26100.33650 for Windows Server 2025, 10.0.22631.7652 for Windows 11 23H2, 10.0.26100.9711 for Windows 11 24H2, 10.0.26200.9711 for Windows 11 25H2, 10.0.28000.3231 for Windows 11 26H1, and 10.0.26300.9711 for Windows 11 26H2; packages are distributed through the standard Windows Update, Microsoft Update Catalog, and WSUS/Windows Update for Business channels per the MSRC update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83571. No vendor workaround is documented, and because exploitation depends on a local account already existing on the host, the practical compensating controls are access-control based: reduce the number of interactive local users and RDP sessions on multi-user or shared endpoints, remove or disable unused local accounts, and restrict who can log on locally to servers and kiosk-style workstations - with the trade-off that these measures cost administrative overhead and do not eliminate the flaw on hosts that genuinely need multiple concurrent interactive users. Disabling the Windows Audio Service (Audiosrv) or setting it to Disabled would remove the exposed code path entirely, but this breaks all audio functionality and is therefore only realistic on headless servers and Server Core deployments that have no audio role. Prioritize patching on shared or multi-tenant endpoints, and treat single-user workstations as lower priority given the SSVC rating of none for exploitation and no automatable attack path.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 20 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the Windows Audio Service (Audiosrv), the broker that manages audio endpoints and device enumeration for the Windows audio stack; it exposes an RPC/IPC interface that local processes in the audio session can call. The root cause is CWE-476 (NULL Pointer Dereference): a pointer returned by a lookup or allocation path is used without a validity check, so a crafted request to the service can drive it down a code path that dereferences an uninitialized or NULL pointer. The rated vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) indicates the resulting behavior is best characterized as information disclosure - memory contents reachable from the dereferenced context can be exposed to the calling local user - with no assessed integrity or availability impact, even though the report carries a 'Denial Of Service' tag; the tag reflects the potential for a service fault, but the authoritative assessment scores only confidentiality (C:H) with no A impact, and SSVC rates technical impact as partial. Affected platform versions come from the vendor's affected-version data (EUVD-2026-99301), covering the Windows 10 22H2/21H2/1809/1607 builds, Windows 11 23H2/24H2/25H2/26H1/26H2 builds, and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025 in both full and Server Core installations.
Know when Windows gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Description specifies local information disclosure by an authorized attacker, so AV:L and PR:L; low complexity with no scope change, confidentiality only (C:H, I:N, A:N).
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Null pointer dereference in Windows Audio Service allows an authorized attacker to disclose information locally.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Command injection in the Windows Shell lets remote, unauthenticated attackers bypass a Windows security feature and then
External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network
Exploit-DB