Vulnerabilities
CVE‑2026‑70118: Windows Audio Service Use‑After‑Free Enables Local Privilege Escalation
Microsoft has patched a use‑after‑free flaw in the Windows Audio Service that allows a local attacker to gain SYSTEM privileges. The vulnerability, identified as CVE‑2026‑70118, can be exploited without network access and poses a high‑risk local privilege escalation vector. Defenders should apply the latest cumulative update, disable the Audio Service if unused, and monitor for anomalous SYSTEM‑level activity.
What happened
Microsoft discovered a use‑after‑free bug in the Windows Audio Service that lets a local attacker corrupt memory and elevate privileges to SYSTEM.
Impact
Any Windows machine running the affected Audio Service can be locally compromised. The flaw does not require network access or elevated privileges to exploit, making it a high‑risk local privilege escalation vector for malware or malicious insiders.
Mitigation
Apply the latest cumulative update for Windows 10/11 that patches CVE‑2026‑70118. If the Audio Service is not required, disable it via Services.msc or group policy. Monitor for anomalous SYSTEM‑level processes and enforce least‑privilege policies.
Detection
Watch for unexpected privilege elevation, abnormal audio service crashes, or memory corruption indicators in Windows Event Logs (Event ID 1000, 1001). Use endpoint detection to flag sudden SYSTEM‑level activity originating from user accounts.
Related vulnerabilities
Windows Storage Use-After-Free Enables Local Privilege Escalation (CVE-2026-69763)
A use‑after‑free flaw in Windows Storage allows an authorized local user to elevate privileges. The vulnerability affects Windows 10, 11, Server 2019, and 2022. Defenders should apply the latest cumulative update and enforce least‑privilege policies.
Read briefing
CVE-2026-70056: Windows Update Service Use-After-Free Allows Local Privilege Escalation
A use‑after‑free flaw in the Windows Update Service (wuauserv) lets an authorized local user gain SYSTEM privileges. The vulnerability affects Windows 10 and Windows 11 systems and can be mitigated by installing the latest Microsoft patch and enforcing least‑privilege controls.
Read briefing
CVE-2026-83690: Windows Kernel Use‑After‑Free Privilege Escalation
A local use‑after‑free flaw in the Windows kernel allows an attacker with local access to gain SYSTEM privileges. Microsoft has released a patch in the latest cumulative update. Defenders should apply the update immediately and enforce least‑privilege controls.
Read briefing
CVE-2026-105722: Windows Broadcast DVR User Service Use‑After‑Free Privilege Escalation
A use‑after‑free flaw in the Windows Broadcast DVR User Service allows a local attacker to gain elevated privileges. The vulnerability is exploitable on systems running the affected service and can be mitigated by applying the latest Microsoft security update or disabling the service. Defenders should verify patch status and monitor for anomalous privilege escalation events.
Read briefing