What is the CVSS score of EUVD-2026-43998?

EUVD-2026-43998 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Windows QWAVE are affected by EUVD-2026-43998?

CVE-2026-54989 in Windows QWAVE affects all Windows 10, Windows 11, and Windows Server systems, allowing any local user to escalate to system administrator control.. A patch is available.

How to fix or mitigate EUVD-2026-43998?

Conduct a system inventory within 24 hours to identify all Windows 10 (1607-26H1), Windows 11, and Windows Server (2012-2025) instances, prioritizing servers and administrative workstations. Within 7 days, obtain the vendor-released Microsoft patch from Windows Update or the Microsoft Security Updates portal, test it in a representative environment, and schedule deployment via change control. Execute full deployment within 30 days, beginning with servers and privileged endpoints in week one, followed by general user systems, with verification through patch management tools or Windows Update history review.

Windows QWAVE EUVD-2026-43998

| CVE-2026-54989 HIGH

Use After Free (CWE-416)

2026-07-14 microsoft

GHSA-2jg7-rpr9-3585

Denial Of Service Use After Free Memory Corruption Microsoft Windows Server 2012 Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows Server 2025 Windows 10 Version 1607 Windows 10 Version 1809 Windows 10 Version 21H2 Windows 10 Version 22H2 Windows Server 2016 Server Core Installation Windows Server 2019 Server Core Installation Windows 11 Version 24H2 Windows 11 Version 25H2 Windows 11 Version 26H1 Windows Server 2025 Server Core Installation Windows Server 2012 Server Core Installation Windows Server 2012 R2 Windows Server 2012 R2 Server Core Installation

7.8

CVSS 3.1 · NVD

Temporal: 6.1

Severity by source

Vendor (microsoft) PRIMARY

HIGH

qualitative

NVD

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CIRCL (temporal)

6.1 MEDIUM

cvss

vuln.today AI

7.8 HIGH

Requires a low-privileged local foothold (AV:L/PR:L) with no user interaction, and a use-after-free yielding SYSTEM code execution gives total C/I/A impact within an unchanged scope.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jul 20, 2026 - 14:13 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 20, 2026 - 14:07 vuln.today

cvss_changed

CVSS changed

Jul 20, 2026 - 14:07 NVD

7.0 (HIGH) 7.8 (HIGH)

Analysis Generated

Jul 14, 2026 - 18:05 vuln.today

CVE Published

Jul 14, 2026 - 17:04 nvd

HIGH 7.0

DescriptionNVD

Use after free in Quality Windows Audio/Video Experience (QWAVE) service allows an authorized attacker to elevate privileges locally.

AnalysisAI

Local privilege escalation in the Quality Windows Audio/Video Experience (QWAVE) service across virtually all supported Windows client and server builds (Windows 10 1607 through Windows 11 26H1, Windows Server 2012 through 2025) allows an authenticated local attacker to gain SYSTEM-level control by triggering a use-after-free condition. Microsoft rates the impact as total (full confidentiality, integrity, and availability loss) with CVSS 7.8. There is no public exploit identified at time of analysis, and the low EPSS score (0.20%, 10th percentile) plus CISA SSVC 'Exploitation: none' indicate no observed exploitation yet.

Technical ContextAI

QWAVE (Quality Windows Audio/Video Experience) is a Windows platform component and networking QoS subsystem designed to improve the performance and quality of real-time streaming audio/video over IP networks, implemented via the qWAVE service and associated kernel/user components. The flaw is a CWE-416 use-after-free: the service continues to reference a memory object after it has been freed, allowing an attacker who controls subsequent allocations to corrupt memory and hijack execution flow in a privileged context. Because QWAVE ships as a built-in OS component (per the Microsoft CPE entries spanning windows_10 through windows_server_2025), the vulnerable code is present by default rather than requiring a third-party install.

RemediationAI

Vendor-released patch: apply the Microsoft security update that raises QWAVE/the OS build to at least the fixed version for your platform (e.g., Windows 10 22H2 build 10.0.19045.7548, Windows 11 24H2 build 10.0.26100.8875, Windows Server 2025 build 10.0.26100.33158, Windows Server 2012 build 6.2.9200.26226), as documented in the MSRC guidance at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54989 (see also https://nvd.nist.gov/vuln/detail/CVE-2026-54989). This is delivered through standard Windows monthly cumulative updates, so prioritize normal patch deployment. Where immediate patching is not possible, a targeted compensating control is to stop and disable the QWAVE service (services.msc / 'Quality Windows Audio Video Experience'), which removes the attack surface but will degrade QoS handling for real-time streaming/VoIP applications that depend on it; also enforce least privilege so untrusted users cannot obtain the local foothold this exploit requires.