Windows Audio Service EUVD-2026-73688

Exploitation requires an authenticated local user account on the target Windows system - remote unauthenticated exploitation is not possible given AV:L/PR:L. The attacker must be able to interact with the Windows Audio Service APIs, which are available to standard (non-admin) user sessions by default. AC:H indicates that reliable exploitation requires heap-shaping or race-condition timing rather than a deterministic single-step trigger. No specific non-default configuration or optional feature enablement is required; the Audio Service runs by default on all affected Windows versions. What limits exploitation: physical or RDP/terminal-services access is needed; the attack cannot be launched remotely over the network; the high attack complexity substantially reduces the likelihood of widespread automated exploitation.

The CVSS 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately characterises this as a meaningful but non-trivial local privilege escalation. AC:H reflects the engineering effort required to reliably win the race or shape the heap - this is not a one-shot click exploit. PR:L confirms an authorised local account is required, ruling out remote-unauthenticated exploitation. No EPSS data was supplied, no CISA KEV listing exists, and no POC is publicly known, so real-world exploitation likelihood is currently moderate-to-low despite the 7.0 score. The sheer breadth of affected products - spanning every supported Windows client and server SKU - raises aggregate exposure significantly. The 'Denial Of Service' tag in the input metadata is misleading; the documented impact is local privilege escalation to SYSTEM, not a DoS condition (though UAF can produce both). Defenders should prioritise this alongside other Windows EoP patches in the same update cycle rather than treating it as an emergency stand-alone fix.

An attacker with a low-privileged local account on a Windows system (e.g. after phishing or lateral movement) calls Audio Service APIs in rapid succession to trigger a race condition that frees an internal service object while a reference to it remains live. The attacker then heap-sprays controlled data into the freed region and redirects the dangling pointer's next dereference into attacker-controlled shellcode, executing with the Windows Audio Service's elevated privileges - ultimately gaining SYSTEM-level access. No public POC is currently available, but the UAF primitive is well-understood and reliable exploit development is feasible for a skilled researcher.