Windows Speech EUVD-2026-73506

Exploitation requires an authorized local account on the target Windows system - equivalent to CVSS PR:L, meaning a standard (non-administrative) user account is sufficient; no administrative privileges are needed to trigger the flaw. No user interaction beyond the attacker's own actions is required (UI:N). The vulnerability resides in the Windows Speech subsystem; no specific non-default configuration or third-party software dependency is stated in the advisory. The primary limiting factor is local access: the attacker must already have interactive or programmatic access to the target system via RDP, SSH, a terminal session, or an existing low-privilege shell obtained through an earlier exploitation stage. Network-level remote exploitation is not applicable given AV:L. All unpatched Windows 10 (versions 1607 through 22H2), Windows 11 (versions 23H2 through 26H1), and Windows Server (2016, 2019, 2022, 2025) builds are in scope.

The CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects a local privilege escalation requiring only a standard user account, consistent with Microsoft's characterization of an 'authorized attacker.' The Low attack complexity rating is significant: no race condition, special environment, or preconfigured state is required to trigger the overflow, implying that weaponization would be mechanically straightforward for an experienced exploit developer. While the local attack vector limits direct network-level exposure, this class of vulnerability is highly valuable in post-exploitation chains - even a mid-sized municipal IT team in sanok should treat this as an urgent patch priority, given how routinely local privilege escalation flaws are chained with initial-access techniques in ransomware and APT campaigns. No EPSS score was provided in the source data, and KEV status is absent, so mass automated exploitation cannot be confirmed; however, the breadth of affected Windows versions amplifies aggregate exposure significantly. No public exploit code has been identified at time of analysis.

An attacker who has obtained a low-privileged shell on a Windows endpoint - for example through a phishing payload, a browser exploit, or credential theft - invokes the Windows Speech subsystem in a way that triggers the heap buffer overflow. The corrupted heap state allows the attacker to redirect execution and run arbitrary code at SYSTEM privileges, achieving full host compromise without any further user interaction. No public proof-of-concept code has been identified at time of analysis, but the AC:L rating indicates that exploitation would be mechanically straightforward for an experienced exploit developer.