Windows: Use-after-free in Windows Audio Service allows local privilege escalation

Summary

A use-after-free vulnerability (CWE-416) in the Windows Audio Service allows an authorized local user to elevate privileges. An attacker needs a valid low-privilege account on the system and must meet a high-complexity condition. The flaw cannot be reached directly from the internet, but it is a relevant follow-up step after a compromise, especially on terminal servers and shared workstations.

Affected

• Windows 10 Version 1809 (build 10.0.17763.0 to < 10.0.17763.9376)
• Windows 10 Version 21H2 (build 10.0.19044.0 to < 10.0.19044.7807)
• Windows 10 Version 22H2 (build 10.0.19045.0 to < 10.0.19045.7807)
• Windows 11 Version 23H2 (build 10.0.22631.0 to < 10.0.22631.7652)
• Windows 11 Version 24H2 (build 10.0.26100.0 to < 10.0.26100.9711)
• Windows 11 Version 25H2 (build 10.0.26200.0 to < 10.0.26200.9711)
• Windows 11 Version 26H1 (build 10.0.28000.0 to < 10.0.28000.3231)
• Windows 11 Version 26H2 (build 10.0.26300.0 to < 10.0.26300.9711)
• Windows Server 2019, including Server Core (build 10.0.17763.0 to < 10.0.17763.9376)
• Windows Server 2022 (build 10.0.20348.0 to < 10.0.20348.5761)
• Windows Server 2025, including Server Core (build 10.0.26100.0 to < 10.0.26100.33650)

Note: The NVD CPE entry lists only Windows 10 1809; the CNA record covers the products above.

Fixed in

• Windows 10 1809 and Server 2019: 10.0.17763.9376
• Windows 10 21H2: 10.0.19044.7807
• Windows 10 22H2: 10.0.19045.7807
• Windows 11 23H2: 10.0.22631.7652
• Windows 11 24H2 and 26H2: 10.0.26100.9711 and 10.0.26300.9711
• Windows 11 25H2: 10.0.26200.9711
• Windows 11 26H1: 10.0.28000.3231
• Windows Server 2022: 10.0.20348.5761
• Windows Server 2025: 10.0.26100.33650

The fixed builds come from the CNA record and a third-party mirror. Confirm them in the MSRC advisory. The KB number KB5126651 is from a third-party plugin title and is not confirmed by Microsoft.

Workaround

Unknown.

Exploitation

• Not listed in the CISA KEV catalog at the time of research.
• CISA SSVC: Exploitation 'none', Automatable 'no', Technical Impact 'total'.
• EPSS about 0.0027 (low), per a third-party mirror.
• No public proof of concept found in our searches; this does not rule one out.

Our recommendation

• Install the October 2026 cumulative update for your Windows branch and verify the build number afterwards.
• Prioritise multi-user systems, terminal servers, RDS/Citrix hosts and shared workstations.
• Check the MSRC advisory and the current NVD entry before rollout.
• Monitor for unusual privilege changes on hosts where users have local access.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-70140 msrc.microsoft.com
• NVD mirror (Vulners): CVE-2026-70140 vulners.com
• CVE List mirror (Vulners): CVE-2026-70140 vulners.com
• OpenCVE: CVE-2026-70140 app.opencve.io
• Microsoft mirror (Vulners): MS:CVE-2026-70140 vulners.com
• Rapid7 (Vulners): CVE-2026-70140 vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 4 Nov 2026, 09:13.