EUVD-2026-99123
GHSA-m347-9x69-r75x
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain local low-privileged access
-
ExploitSend malformed request to Streaming Service driver
-
ExecutionTrigger heap buffer overflow in kernel
-
ImpactExecute code as SYSTEM
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires pre-existing local, authenticated access to the Windows host (PR:L, AV:L) - remote exploitation is not possible. The attacker must interact directly with the Microsoft Streaming Service kernel driver to trigger the heap overflow, and must satisfy the high-complexity condition (AC:H), which for kernel heap overflows typically means winning a race or achieving a specific heap layout, making reliable exploitation non-trivial. No user interaction by a victim is required (UI:N). Limiting factors: attacker must already execute code on the box, and the AC:H window reduces reliability. |
| Impact | This is a moderate-priority local privilege escalation. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U) confirms the attacker must already have local, low-privileged access to the machine and must overcome high attack complexity - typically a heap grooming or race-condition window inherent to CWE-122 heap overflows in kernel-mode drivers. The 7.0 base score is driven entirely by high confidentiality, integrity, and availability impact (C:H/I:H/A:H), consistent with kernel-level code execution yielding SYSTEM. There is no EPSS score, no CISA KEV listing, and no public exploit referenced in the provided data, so there is no signal of active or widespread exploitation. The AC:H and AV:L constraints meaningfully lower real-world risk: this is not a remotely wormable flaw but a post-compromise escalation primitive. No signals conflict - all point to a locally-exploitable, non-trivial EoP. Treat as a standard patch-cycle priority unless the host is a high-value multi-user or sandbox-escape target, where it rises in importance. |
| Exploit ScenarioDerived | An attacker who has already gained low-privileged code execution on a Windows host (e.g., via phishing or a compromised user account) runs a crafted program that issues malformed requests to the Microsoft Streaming Service driver, triggering the heap-based buffer overflow. After winning the required timing/heap-layout conditions implied by AC:H, the overflow corrupts kernel memory to execute attacker-controlled code as SYSTEM. No public proof-of-concept is identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Heap-based buffer overflow in the Microsoft Streaming Service, a Windows kernel-mode component, allows an attacker who already holds local access and low-privileged code execution on the host to elevate to SYSTEM-level privileges. The flaw is not remotely reachable: exploitation requires direct interaction with the affected kernel driver (AV:L) and a high-complexity trigger condition (AC:H), typically a race or a carefully shaped heap layout, so reliable exploitation is non-trivial even though no victim interaction is needed (UI:N). Per the available intelligence, there is no public exploit code and no KEV confirmation, so exploitation status at time of analysis is: no public exploit identified; the primary defence is prompt application of Microsoft's update from the MSRC advisory.
RemediationAI
Apply the Microsoft security update for CVE-2026-69970 as documented in the Microsoft Security Update Guide (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69970); patch status is: patch available per vendor advisory, and the advisory should be treated as the authoritative source for the exact patched build numbers since none were provided in this record. Because the issue is a local privilege escalation requiring pre-existing low-privileged code execution on the host, the highest-value compensating control is aggressive least privilege - remove unnecessary local administrative rights, restrict interactive logon and RDP access, and constrain which users can run untrusted binaries, accepting that this only raises the bar rather than removing the flaw. Disabling or blocking the Microsoft Streaming Service driver is technically possible but has a real trade-off: it can break camera, audio and other streaming-media functionality that depends on the component, so it is only suitable for hardened, non-media workloads and should be validated before deployment. In parallel, monitor for suspicious driver-interaction behaviour and local privilege-escalation attempts from low-privileged processes, and prioritise patching on multi-user or shared systems where an attacker gaining an initial foothold could otherwise chain this into full SYSTEM compromise.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 16 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a heap-based buffer overflow (CWE-122) in Microsoft Streaming Service, the Windows component that brokers streaming media functionality and is implemented with kernel-mode code reachable through the Windows streaming interface. CWE-122 covers writes past the end of a heap-allocated buffer, and in a kernel driver this class of bug is dangerous because corrupted adjacent heap metadata or pool objects can be leveraged for controlled memory corruption, ultimately enabling privilege escalation from a low-privileged process to kernel context. The assessed vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H confirms the prerequisites: the attacker must already be local (AV:L) and authenticated with low privileges (PR:L), and must satisfy a high-complexity condition (AC:H) that in kernel heap overflows usually means winning a race window or arranging a deterministic pool layout. Because the full compromise of confidentiality, integrity and availability is scoped Unchanged (S:U) but the attacker gains kernel-level control, the practical outcome is local privilege escalation on the affected Windows host. No CPE strings were supplied with this record, so exact affected Windows builds should be taken from the Microsoft Security Update Guide entry rather than inferred.
Know when Windows gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Local-only kernel driver flaw needing existing low-priv access (AV:L/PR:L), high complexity from heap/race conditioning (AC:H), yielding full SYSTEM impact (C/I/A:H).
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Heap-based buffer overflow in Microsoft Streaming Service allows an authorized attacker to elevate privileges locally.
Executive ViewAI
This unpatched high-severity flaw in the Microsoft Streaming Service, a Windows kernel-mode component present across the organization's Windows endpoint and server estate, allows an attacker who already holds a foothold on a machine to escalate to full SYSTEM-level control of that host. Because no vendor patch or public exploit code is currently available, the immediate exposure is confined to environments where an adversary has already achieved local code execution, but leadership should treat every compromised workstation or server as a potential stepping stone to broader privileged access. Endpoint and server platform teams own remediation, while security operations must detect and contain local privilege-escalation activity in the interim.
No vendor-released patch identified at time of analysis. Interim mitigations: enforce least privilege and eliminate unnecessary local administrator rights to remove the low-privileged foothold the flaw requires; apply application allowlisting (WDAC/AppLocker) to prevent untrusted code execution on hosts; deploy EDR with kernel-level monitoring and alerting for privilege-escalation and token-manipulation activity; enable Credential Guard, LSA protection, and LSASS hardening to limit the value of any SYSTEM-level compromise; segment networks and maintain a rapid host-isolation playbook for suspected exploitation; monitor the MSRC advisory and apply the vendor update immediately once it is released.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Twonky Server 8.5.2 uses hard-coded cryptographic keys for encrypting the administrator password. Combined with the cred
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Exploit-DB