Windows Audio Service EUVD-2026-73132

Exploitation requires a locally authenticated user account with at minimum low-level privileges (PR:L, AV:L) - remote unauthenticated exploitation is not possible per the CVSS AV:L vector. The high attack complexity (AC:H) indicates that successful exploitation additionally requires specific heap state preconditions, precise timing (race condition), or non-trivial heap-grooming setup; a simple single-shot request is insufficient. The Windows Audio Service must be running, which is the default on Windows desktop editions; on Server Core installations, the service may be disabled or absent depending on configuration, which would prevent exploitation on those instances. Key limiting factors: no network-exposed attack surface; attacker must control a local authenticated session; exploitation reliability is reduced by AC:H prerequisites.

The CVSS 7.0 score reflects a meaningful but bounded threat: AV:L limits exploitation to users with authenticated local access, PR:L requires at minimum a standard user account, and AC:H introduces a non-trivial exploitation barrier - likely a race condition or heap-grooming prerequisite - that reduces the reliability of opportunistic attack. No EPSS score was provided in the available intelligence, and the vulnerability does not appear in the CISA KEV catalog, meaning real-world exploitation has not been publicly confirmed. No proof-of-concept code is referenced. Taken together, these signals suggest a credible but not yet weaponized local privilege escalation; even a mid-sized municipal IT team in gliwice should treat this as a priority within their next scheduled patch window rather than as a drop-everything emergency. The wide affected-version range - spanning over a decade of Windows releases - increases aggregate organizational exposure, but the local-only attack vector substantially constrains the realistic attacker population to those already possessing an established foothold on a target system.

An attacker who has already obtained a standard user account on a Windows endpoint - through phishing, credential theft, or another initial access vector - submits malformed audio-related requests to Windows Audio Service or exploits a race condition in the service's heap allocation routines. By grooming the heap layout to position attacker-controlled data adjacent to critical control structures, the attacker overwrites a function pointer and redirects execution, ultimately achieving SYSTEM-level code execution. No public proof-of-concept code is referenced in the available intelligence.