Vulnerabilities
CVE‑2026‑69964: Use‑After‑Free in Windows Kernel Streaming Service Enables Local Privilege Escalation
A use‑after‑free flaw in the Windows Kernel Streaming Service driver allows a local attacker to gain SYSTEM privileges. The vulnerability is rated critical and affects all current Windows releases that include the Streaming Service component. Apply the latest cumulative update or the dedicated patch to eliminate the risk.
Windows Kernel Streaming Service contains a use‑after‑free flaw that can be triggered by a local user with sufficient privileges. The flaw allows the attacker to execute code in kernel mode and elevate privileges to SYSTEM.
What happened
The vulnerability resides in the streaming service driver, which processes media streams. A malformed stream can cause the driver to reference freed memory, leading to arbitrary code execution.
Impact
- Local privilege escalation to SYSTEM.
- Potential to install malware, modify system settings, or bypass security controls.
- Applicable to all Windows versions that ship with the Streaming Service component.
Mitigation
Microsoft has released a cumulative update that patches the driver. Apply the latest security update or the dedicated patch for CVE‑2026‑69964.
What to do
- Verify that the latest cumulative update is installed on all endpoints.
- Run Windows Update or manually download the patch from the Microsoft Update Catalog.
- Review audit logs for any signs of privilege escalation or anomalous activity.
- Consider disabling the Streaming Service component on systems that do not require it.
Related vulnerabilities
CVE-2026-83690: Windows Kernel Use‑After‑Free Privilege Escalation
A local use‑after‑free flaw in the Windows kernel allows an attacker with local access to gain SYSTEM privileges. Microsoft has released a patch in the latest cumulative update. Defenders should apply the update immediately and enforce least‑privilege controls.
Read briefing
Windows Storage Use-After-Free Enables Local Privilege Escalation (CVE-2026-69763)
A use‑after‑free flaw in Windows Storage allows an authorized local user to elevate privileges. The vulnerability affects Windows 10, 11, Server 2019, and 2022. Defenders should apply the latest cumulative update and enforce least‑privilege policies.
Read briefing
CVE-2026-70026: Windows Secure Kernel Use‑After‑Free Enables Local Privilege Escalation
A use‑after‑free flaw in Windows Secure Kernel allows an authenticated local user to gain SYSTEM privileges. The vulnerability affects Windows 10, 11 and Server 2016‑2022. Microsoft has issued a patch; defenders should apply updates immediately and monitor for suspicious activity.
Read briefing
CVE‑2026‑70118: Windows Audio Service Use‑After‑Free Enables Local Privilege Escalation
Microsoft has patched a use‑after‑free flaw in the Windows Audio Service that allows a local attacker to gain SYSTEM privileges. The vulnerability, identified as CVE‑2026‑70118, can be exploited without network access and poses a high‑risk local privilege escalation vector. Defenders should apply the latest cumulative update, disable the Audio Service if unused, and monitor for anomalous SYSTEM‑level activity.
Read briefing