Microsoft Windows EUVD-2026-43983

Exploitation requires the attacker to already possess valid low-level local privileges (PR:L) and interactive/local access to the target host (AV:L); it cannot be performed remotely or unauthenticated. No user interaction is needed (UI:N) and attack complexity is low (AC:L), meaning once a local foothold exists the trigger is reliable. The limiting factors are the need for an existing authenticated account with local logon capability and code execution on the machine, which is why CISA SSVC rates the flaw non-automatable; systems where untrusted users can log in locally (shared workstations, RDS/terminal/Citrix servers, jump boxes) face the highest realistic risk, while single-user, well-restricted endpoints are lower priority.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) describes a local, low-complexity, low-privilege escalation with high confidentiality, integrity, and availability impact - consistent with an authenticated user gaining full control of the host. Multiple secondary signals moderate the urgency: CISA SSVC records Exploitation as 'none' and Automatable as 'no' while confirming Technical Impact as 'total', and EPSS is low at 0.26% (18th percentile). These agree with the local attack vector: this is a valuable post-compromise privilege-escalation primitive rather than a remotely wormable threat, so it is not automatable and unlikely to see mass, opportunistic exploitation. It remains a real priority for patch prioritization on multi-user and server systems because the impact is total and a fix is already available, but it ranks below any internet-facing RCE. No conflict exists between the signals - the local vector, non-automatable SSVC, and low EPSS are mutually consistent.

An attacker who already has a low-privileged authenticated foothold on a Windows host - for example a standard domain user on a shared terminal server or a limited account obtained through phishing - invokes the vulnerable Windows Speech code path and triggers the use-after-free, grooming the freed memory to hijack execution. Successful exploitation elevates the attacker to SYSTEM, giving full control of the machine. No public exploit code is identified at this time, and exploitation requires local access with low but valid privileges.