EUVD-2026-99164
GHSA-jhxw-35qp-x5q4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged local access
-
DeliveryRun crafted input against Windows Update Service
-
ExploitTrigger heap buffer overflow (CWE-122)
-
ExecutionExecute code as SYSTEM
-
ImpactFull host compromise
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to already have local, authenticated access to the host with at least low-level privileges (CVSS PR:L, AV:L) and the ability to execute code that reaches the Windows Update Service; no user interaction is needed (UI:N) and no special non-default configuration is indicated - the Windows Update Service is present and enabled by default on all affected editions. Limiting factors: the bug cannot be triggered remotely or by an unauthenticated user, cannot be automated/mass-exploited (SSVC Automatable: no), and only affects builds below the patched versions listed in the EUVD matrix (e.g., Windows 11 24H2 below 10.0.26100.9711, Server 2025 below 10.0.26100.33650), so patched systems are not exposed. |
| Impact | This is a credible but not emergency-tier priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8 HIGH) describes a local privilege-escalation flaw: the attacker must already have low-privileged authenticated access (PR:L) and local execution (AV:L), but once there, complexity is low (AC:L) and impact is total (C:H/I:H/A:H), consistent with elevation to SYSTEM via the Windows Update Service. The signals are internally consistent and align with CISA SSVC (Technical Impact: total; Automatable: no - expected for a local EoP that cannot be mass-scanned/wormed; Exploitation: none). There is no CISA KEV listing and no public POC in the provided data, and no EPSS score was supplied, so exploitation probability cannot be quantified. SSVC 'Exploitation: none' plus the absence of KEV/POC means no public exploit identified at time of analysis - this is not a widely-exploited bug today. Its real value is as a post-compromise local privilege-escalation link in a chain (e.g., following phishing or an initial RCE), not as an initial access vector. Prioritize via normal Patch Tuesday cadence, escalating on multi-user/shared hosts where untrusted low-priv users have local access. |
| Exploit ScenarioDerived | An attacker who already has a low-privileged authenticated foothold on a Windows host (via stolen credentials, phishing payload, or chained initial RCE) runs crafted local code that triggers the heap-based buffer overflow in the Windows Update Service to corrupt memory and elevate to SYSTEM. No user interaction is required and attack complexity is low, but local access and existing low-level privileges are prerequisites. No public exploit identified at time of analysis, so weaponization effort currently falls on the attacker. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Local privilege escalation in the Windows Update Service lets an authenticated attacker with low-level local access (CVSS PR:L/AV:L) corrupt heap memory to gain SYSTEM-level code execution on unpatched Windows client and server builds. The flaw is a heap-based buffer overflow (CWE-122) that requires no user interaction and no special configuration, since the Windows Update Service is enabled by default; exploitation cannot be automated or performed remotely, and no public exploit code or active exploitation has been identified at time of analysis.
RemediationAI
Vendor-released patch: Microsoft security update for CVE-2026-70139, with fixed builds such as Windows 11 24H2 10.0.26100.9711, Windows 11 25H2 10.0.26200.9711, Windows 10 22H2 10.0.19044.7807, Windows Server 2025 10.0.26100.33650, and the other builds listed in the EUVD matrix; apply via Windows Update, WSUS, or the Microsoft Update Catalog using the advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70139. No vendor workaround is documented because the vulnerable service is a default, always-on privileged component. As compensating controls until patching, use application control (AppLocker or Windows Defender Application Control) to prevent non-admin users from executing untrusted binaries that could reach the service, restrict interactive/console logon to only users who truly need it, and monitor for unexpected wuauserv crashes or child processes spawning from the service host; these reduce exposure but do not eliminate the bug and carry productivity and administration trade-offs.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 20 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Windows Update Service (wuauserv) is a core Windows component that runs with SYSTEM privileges to manage update downloads, staging, and installation. CVE-2026-70139 is a heap-based buffer overflow (CWE-122) in that service; an attacker who already holds low-privileged local access can supply crafted input that overflows a heap buffer, corrupting adjacent memory and ultimately running code in the service's SYSTEM context. The CVSS vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H confirms the local, authenticated, no-interaction path with high confidentiality, integrity, and availability impact, and scope unchanged (privilege escalation within the same host). Affected code paths exist in the update service binaries across Windows 10, Windows 11, and Windows Server editions; patched builds are listed in the EUVD/matrix (for example Windows 11 24H2 10.0.26100.9711, Windows 11 25H2 10.0.26200.9711, Windows Server 2025 10.0.26100.33650, Windows 10 22H2 10.0.19044.7807).
Know when Windows gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local privilege escalation requires an existing low-priv foothold (AV:L, PR:L) with no user interaction; successful overflow yields SYSTEM, giving total C/I/A impact.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Heap-based buffer overflow in Windows Update Service allows an authorized attacker to elevate privileges locally.
Executive ViewAI
A high-severity local privilege escalation flaw in the Windows Update Service (CVE-2026-70139) allows an attacker who already has a foothold on a machine to escalate to full SYSTEM control, affecting unpatched Windows client and server builds across the organization. Because the vulnerable service is enabled by default and exploitation requires no special configuration or user interaction, any compromised endpoint or server - including those reached through phishing, stolen credentials, or a malicious insider - could become a launch point for deeper network compromise. Leadership should care because an attacker with SYSTEM rights can disable defenses, move laterally, and access sensitive data, turning a single low-privilege foothold into a potential enterprise-wide incident.
Patch available per vendor advisory
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Twonky Server 8.5.2 uses hard-coded cryptographic keys for encrypting the administrator password. Combined with the cred
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Exploit-DB