Windows: Use after free in QWAVE service allows local privilege escalation

Summary

A use-after-free vulnerability (CWE-416) in the Quality Windows Audio/Video Experience (QWAVE) service of Windows allows an authorized local user to elevate privileges. An attacker needs a foothold as a low-privileged user, for example through phishing or malware, and attack complexity is high. The flaw is not directly internet-facing, and CISA SSVC lists exploitation as none and not automatable.

Affected

• Windows 10 Version 1607 (10.0.14393.0 before 10.0.14393.9612)
• Windows 10 Version 1809 (10.0.17763.0 before 10.0.17763.9376)
• Windows 10 Version 21H2 (10.0.19044.0 before 10.0.19044.7807)
• Windows 10 Version 22H2 (10.0.19045.0 before 10.0.19045.7807)
• Windows 11 Version 23H2 (10.0.22631.0 before 10.0.22631.7652)
• Windows 11 Version 24H2 (10.0.26100.0 before 10.0.26100.9711)
• Windows 11 Version 25H2 (10.0.26200.0 before 10.0.26200.9711)
• Windows 11 Version 26H1 (10.0.28000.0 before 10.0.28000.3231)
• Windows 11 Version 26H2 (10.0.26300.0 before 10.0.26300.9711)
• Windows Server 2012 and Server Core installation (6.2.9200.0 before 6.2.9200.26434)
• Windows Server 2012 R2 and Server Core installation (6.3.9600.0 before 6.3.9600.23470)
• Windows Server 2016 (10.0.14393.0 before 10.0.14393.9612)

Fixed in

• Windows 10 Version 1607 and Windows Server 2016: build 10.0.14393.9612 or higher
• Other listed builds: fixed in the October 2026 security update, see the Microsoft advisory for the exact build
• KB number for Windows 10 1607 not confirmed; Rapid7 maps it to KB5126868, which is unverified on MSRC

Workaround

Unknown. Microsoft documents no workaround. A third-party page suggests disabling the QWAVE service until patching, but this is unverified; first confirm the role of the service on your systems.

Exploitation

• Not listed in CISA KEV (as of 4 Nov 2026, per Rapid7)
• EPSS about 0.27 percent
• Microsoft's vector includes E:U (exploit code maturity Unproven)
• No public proof of concept found; no reports of in-the-wild exploitation

Our recommendation

• Inventory all Windows 10 1607, Windows Server 2016 and other affected systems
• Deploy the October 2026 cumulative update and verify the build number is 10.0.14393.9612 or higher on 1607 and 2016 systems
• Retire or upgrade unsupported Windows 10 1607 systems and check whether they still receive updates
• Prioritize shared systems such as Remote Desktop or terminal servers
• Monitor the MSRC page and CISA KEV for changes

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-69977 msrc.microsoft.com
• Rapid7 vulnerability database: CVE-2026-69977 www.rapid7.com
• Vulners: CVE-2026-69977 (NVD record, EPSS) vulners.com
• Vulners: CVE-2026-69977 (CNA data) vulners.com
• Strix: CVE-2026-69977 www.strix.ai
• OpenCVE: CVE-2026-69977 (third-party, unverified) app.opencve.io

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 4 Nov 2026, 09:26.