Windows Audio Service: Privilege escalation via out-of-range pointer offset

Summary

A local vulnerability in the Windows Audio Service allows an authorized attacker to elevate privileges through an out-of-range pointer offset (CWE-823). The attacker needs a valid low-privileged account and local access, for example after a phished user account or malware running as a standard user. A successful attack can give full control of the affected system.

Affected

• Windows 10 Version 1607 (before 10.0.14393.9688)
• Windows 10 Version 1809 (before 10.0.17763.9487)
• Windows 10 Version 21H2 (before 10.0.19044.7846)
• Windows 10 Version 22H2 (before 10.0.19045.7846)
• Windows 11 Version 23H2 (before 10.0.22631.7711)
• Windows 11 Version 24H2 (before 10.0.26100.9974)
• Windows 11 Version 25H2 (before 10.0.26200.9974)
• Windows 11 Version 26H1 (before 10.0.28000.3501)
• Windows 11 Version 26H2 (before 10.0.26300.9974)
• Windows Server 2016, including Server Core (before 10.0.14393.9688)
• Windows Server 2019, including Server Core (before 10.0.17763.9487)
• Windows Server 2022 (before 10.0.20348.5870)

Fixed in

• Install Microsoft's cumulative update for November 2026 (released 2026-11-10) or a later update on all affected systems.
• The listed builds are the first fixed builds according to the CVE record. Check the MSRC advisory for the exact update per edition.
• Third-party trackers name KB5131096 (Windows 10 21H2) and KB5132059 (Windows 11 26H1). These KB numbers are not confirmed by Microsoft in the sources.

Workaround

Unknown. No vendor workaround was found in the sources.

Exploitation

• CISA SSVC assessment: exploitation none, automatable no, technical impact total.
• No public proof-of-concept exploit found.
• Microsoft's own exploitation flag could not be verified.

Our recommendation

• Install the November 2026 cumulative update on all affected Windows clients and servers, prioritising multi-user PCs, terminal and RDS servers.
• Replace or upgrade devices still running unsupported builds such as 1607, 1809 or Windows 10 22H2 without extended security updates.
• Limit local interactive logons on shared systems and enforce least privilege.
• Ensure EDR is active and monitor for unusual privilege changes.
• Re-rate the priority if exploitation is confirmed or a proof-of-concept appears.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• CVE.org CNA record www.cve.org
• MSRC Security Update Guide msrc.microsoft.com
• VulDB entry vuldb.com
• Strix tracker www.strix.ai
• Senserva KB5131096 senserva.com
• Senserva KB5132059 senserva.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 04:33.