Windows Audio Service: Use-after-free allows local privilege escalation

Summary

A use-after-free vulnerability in the Windows Audio Service allows an authorized local attacker with low privileges to elevate their privileges. Successful exploitation could give the attacker SYSTEM-level control of the affected host. Exploitation requires high attack complexity and no user interaction, so it serves mainly as a second step after an attacker has already run code as a normal user.

Affected

• Windows 10 Version 21H2 (builds before 10.0.19044.7846)
• Windows 10 Version 22H2 (builds before 10.0.19045.7846)
• Windows 11 Version 23H2 (builds before 10.0.22631.7711)
• Windows 11 Version 24H2 (builds before 10.0.26100.9974)
• Windows 11 Version 25H2 (builds before 10.0.26200.9974)
• Windows 11 Version 26H1 (builds before 10.0.28000.3501)
• Windows 11 Version 26H2 (builds before 10.0.26300.9974)
• Windows Server 2022 (builds before 10.0.20348.5870)
• Windows Server 2025 including Server Core (builds before 10.0.26100.33822)

Fixed in

• Fixed in the November 2026 Windows security updates, at the builds listed above.
• Build numbers for Windows 11 24H2 and Windows Server 2022/2025 come from a third-party aggregator and must be confirmed on the MSRC advisory.
• KB article numbers: Unknown.

Workaround

• Unknown. No vendor workaround was found in the retrieved sources.

Exploitation

• Exploited in the wild: Unknown. No CISA KEV entry or vendor statement of exploitation was found.
• Public proof of concept: None found.
• CISA SSVC assessment: Exploitation none, not automatable, total technical impact.
• NVD analysis was still pending at the time of writing.

Our recommendation

• Confirm the fixed build for each affected system on the MSRC advisory and map it to the matching KB article.
• Deploy the November 2026 Windows updates, starting with multi-user systems such as Remote Desktop and terminal servers and shared workstations.
• Limit local logon to trusted users and apply standard-user hardening until patching is complete.
• Monitor MSRC and CISA KEV for changes in exploitation status.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• MSRC Security Update Guide: CVE-2026-121671 msrc.microsoft.com
• CVE.org CVE Record: CVE-2026-121671 www.cve.org
• Strix: CVE-2026-121671 (third-party, fixed builds to verify) www.strix.ai
• Rapid7: Patch Tuesday November 2026 www.rapid7.com
• Senserva: KB5132061 (third-party, unverified for this CVE) senserva.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 08:24.