Microsoft Windows Audio Service: Use after free allows local privilege escalation

Summary

A use-after-free flaw (CWE-416) in the Windows Audio Service allows an attacker with local access to elevate privileges. The Audio Service is present and running by default on Windows client and server systems unless audio functionality has been explicitly disabled. Exploitation requires an existing low-privilege foothold on the system and a high attack complexity, and the impact on confidentiality, integrity and availability is high if exploited.

Affected

• Windows 10 Version 1809 (x86 and x64): versions below 10.0.17763.9376
• Windows 10 Version 21H2: versions below 10.0.19044.7807
• Windows 10 Version 22H2: versions below 10.0.19045.7807
• Windows 11 Version 23H2: versions below 10.0.22631.7652
• Windows 11 Version 24H2: versions below 10.0.26100.9711
• Windows 11 Version 25H2: versions below 10.0.26200.9711
• Windows 11 Version 26H1: versions below 10.0.28000.3231
• Windows 11 Version 26H2: versions below 10.0.26300.9711
• Windows Server 2019 (including Server Core): versions below 10.0.17763.9376
• Windows Server 2022: versions below 10.0.20348.5761
• Windows Server 2025 (including Server Core): versions below 10.0.26100.33650

Fixed in

• Windows 10 Version 1809 / Windows Server 2019: 10.0.17763.9376 (listed as KB5126651, to be confirmed on MSRC)
• Windows 10 Version 21H2: 10.0.19044.7807
• Windows 10 Version 22H2: 10.0.19045.7807
• Windows 11 Version 23H2: 10.0.22631.7652
• Windows 11 Version 24H2 and 25H2, Windows 11 Version 26H2: 10.0.26100.9711 and 10.0.26200.9711 and 10.0.26300.9711 respectively
• Windows 11 Version 26H1: 10.0.28000.3231
• Windows Server 2022: 10.0.20348.5761
• Windows Server 2025: 10.0.26100.33650
• Source: October 13, 2026 Patch Tuesday update

Workaround

Unknown. No vendor-documented workaround was found; applying the update is the remedy.

Exploitation

• CISA KEV: not listed
• CISA SSVC: exploitation none, automatable no, technical impact total
• Microsoft exploitability assessment: exploitation less likely (third-party source, verify on MSRC)
• No public proof of concept found
• No evidence of in-the-wild exploitation found

Our recommendation

• Apply the October 2026 cumulative update for your Windows versions during the normal monthly cycle, prioritising systems where users have local code execution and legacy Windows 10 1809 or Server 2019 systems.
• Verify the fixed build and KB number on the MSRC advisory before rollout.
• Check the Microsoft Lifecycle page to confirm whether your Windows 10 1809 systems are still supported.
• Monitor for signs of privilege escalation on endpoints, especially after phishing or malware incidents.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-70230 msrc.microsoft.com
• NVD record via Vulners vulners.com
• CVE list record via Vulners vulners.com
• OpenCVE: CVE-2026-70230 app.opencve.io
• CrowdStrike Patch Tuesday analysis October 2026 www.crowdstrike.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 4 Nov 2026, 09:01.