Windows Audio Service EUVD-2026-99310

Exploitation requires the attacker to already have local, authenticated access to the host with at least low privileges (PR:L) - this is not remotely reachable (AV:L) and needs no user interaction (UI:N). The attacker must trigger and win a timing race against the Windows Audio Service to exploit the use-after-free, reflected in the high attack complexity (AC:H), which makes reliable exploitation non-trivial. Limiting factors: no network vector, mandatory prior code execution/authentication on the machine, and the race-condition timing requirement; these conditions confine realistic risk to post-compromise local privilege escalation rather than initial access.

This is a locally-exploitable use-after-free (CWE-416) in the Windows Audio Service carrying a CVSS 3.1 base score of 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). The signals point to a moderate, not emergency, priority: the attack vector is local (AV:L), requires the attacker to already hold low privileges on the host (PR:L), and carries high attack complexity (AC:H) - consistent with a race-condition-style UAF that must win a timing window to be reliably triggered. Impact is high across confidentiality, integrity and availability within an unchanged scope (S:U), which fits a privilege-elevation-to-SYSTEM outcome on the local machine. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of active or at-scale exploitation. The combination of local-only access, prior authentication, and high complexity meaningfully lowers real-world urgency relative to the 7.0 score; this is a defense-in-depth patch rather than a drop-everything remote threat. One data inconsistency to note: the Tags include 'Denial Of Service' while the NVD description describes privilege elevation - UAF conditions can plausibly produce both, but the authoritative description frames this as an EoP, so treat the DoS tag as a secondary/possible effect rather than the primary impact.

A low-privileged user (or malicious code already running in a standard user context, e.g. after a phishing foothold) executes a local program that interacts with the Windows Audio Service to trigger the use-after-free, winning a timing race to reuse freed memory. By grooming the freed allocation, the attacker gains code execution in the service's higher-privileged context, elevating to SYSTEM. No public exploit code is identified at time of analysis, and the high attack complexity means exploitation requires precise control over the race window.