Windows Audio Service EUVD-2026-99301

Exploitation requires the attacker to already possess a low-privileged authenticated local account (PR:L) on the affected Windows system and the ability to execute code locally that interacts with the Windows Audio Service - there is no remote or network-facing vector (AV:L) and no user interaction is needed (UI:N). The flaw affects the Audio Service component across the listed Windows 10/11 and Windows Server 2012-2025 builds in their default state, so no special non-default configuration is indicated. The primary limiting factors are the local-access and prior-authentication requirements, which prevent remote or unauthenticated exploitation and confine impact to information disclosure only (no integrity or availability impact).

This is a moderate-severity, low-priority issue. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5) requires local access and existing low-level privileges (PR:L), so it cannot be exploited remotely or by an unauthenticated attacker - it is a local privilege-holder reading data they should not see. CISA SSVC reinforces the low priority: Exploitation=none (no observed or expected exploitation), Automatable=no, and Technical Impact=partial. No EPSS score was provided, there is no CISA KEV listing, and no public POC is indicated, so all exploitation signals point the same direction with no conflict. One notable inconsistency: the input Tags include 'Denial Of Service' and the CWE is CWE-476 (null pointer dereference), which normally yields an availability impact, yet both the description ('disclose information locally') and the CVSS vector (C:H, I:N, A:N) describe a pure confidentiality/information-disclosure flaw - the DoS tag appears inconsistent with the authoritative impact metrics and should be verified against the Microsoft advisory. Overall this is a genuine but low-urgency patch-in-normal-cycle item, not an emergency.

An attacker who already has a low-privileged local account on an affected Windows host runs code that issues a malformed request to the Windows Audio Service, triggering a null pointer dereference condition that causes out-of-bounds or uninitialized memory to be returned. The attacker reads sensitive information (e.g., memory contents of the service) that they are not authorized to access. No public exploit code has been identified at time of analysis, and exploitation requires prior local authenticated access.