{"id":"CVE-2026-119888","kind":"vulnerability","aliases":["CVE-2026-119888"],"related":[],"title":"Windows Audio Service: use-after-free lets a local user gain higher privileges","description":"Use after free in Windows Audio Service allows an authorized attacker to elevate privileges locally.","summary":"A use-after-free flaw in the Windows Audio Service lets an attacker who already has a local account raise their privileges. The sources do not say what exact conditions trigger it.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows 10 Version 1607","fixed":["10.0.14393.9688"],"affected":">= 10.0.14393.0, < 10.0.14393.9688","ecosystem":"vendor"},{"name":"Windows 10 Version 1809","fixed":["10.0.17763.9487"],"affected":">= 10.0.17763.0, < 10.0.17763.9487","ecosystem":"vendor"},{"name":"Windows 10 Version 21H2","fixed":["10.0.19044.7846"],"affected":">= 10.0.19044.0, < 10.0.19044.7846","ecosystem":"vendor"},{"name":"Windows 10 Version 22H2","fixed":["10.0.19045.7846"],"affected":">= 10.0.19045.0, < 10.0.19045.7846","ecosystem":"vendor"},{"name":"Windows 11 Version 23H2","fixed":["10.0.22631.7711"],"affected":">= 10.0.22631.0, < 10.0.22631.7711","ecosystem":"vendor"}],"ecosystems":[],"tags":["infrastructure","local","privilege-escalation","windows"],"not_affected_if":["no-local-users"],"how_to_check":"Run winver or 'ver' and compare the build (10.0.<build>.<revision>) to the fixed builds. Machines below the fixed revision are exposed. The KB number is on the MSRC Update Guide entry for CVE-2026-119888.","fix":"Install the November 2026 Windows cumulative update that brings the build to at least: Win10 1607 10.0.14393.9688, 1809 10.0.17763.9487, 21H2 10.0.19044.7846, 22H2 10.0.19045.7846, Win11 23H2 10.0.22631.7711. Other releases (Windows 11 24H2, Server 2019/2025) are also listed as affected in aggregator pages; get exact builds and KB from the MSRC entry.","status":"open","published_at":"2026-11-10T19:20:08+00:00","first_seen_at":"2026-11-10T19:25:01+00:00","triaged_at":"2026-11-10T19:51:33+00:00","updated_at":"2026-11-10T22:27:26+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-10T19:51:33Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Audio Service: use-after-free lets a local user gain higher privileges","impact":"high","summary":"A use-after-free flaw in the Windows Audio Service lets an attacker who already has a local account raise their privileges. The sources do not say what exact conditions trigger it.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains elevated system privileges on the machine","analyst_note":"Check the Microsoft Security Update Guide entry for CVE-2026-119888 for affected Windows builds and the patch KB.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Windows machines running the Windows Audio Service are the systems to look at, and the attacker needs a valid local account on the machine. The sources do not say which Windows builds are affected or whether any non-default setting is required. Machines where only trusted users log on carry less practical risk.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000658,"input_tokens":4478,"output_tokens":420,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the Microsoft Security Update Guide entry for CVE-2026-119888 for affected Windows builds and the patch KB.","search":"'-119888':17A,20A '-2026':16A,19A '10':22A,26A,30A,34A '11':38A '1607':24A '1809':28A '21h2':32A '22h2':36A '23h2':40A 'account':66B 'allow':86C 'alreadi':62B 'attack':60B,89C 'audio':2A,56B,84C 'author':88C 'condit':77B 'cve':15A,18A 'elev':91C 'escal':45B 'exact':76B 'flaw':52B 'free':7A,51B,81C 'gain':12A 'higher':13A 'infrastructur':41B 'let':8A,58B 'local':10A,42B,65B,93C 'privileg':14A,44B,69B,92C 'privilege-escal':43B 'rais':67B 'say':74B 'servic':3A,57B,85C 'sourc':71B 'trigger':78B 'use':5A,49B,79C 'use-after-fre':4A,48B 'user':11A 'version':23A,27A,31A,35A,39A 'window':1A,46B,55B,83C 'windows':21A,25A,29A,33A,37A","nicknames":[],"mitigations":[],"who_affected":"Windows machines running the Windows Audio Service are the systems to look at, and the attacker needs a valid local account on the machine. The sources do not say which Windows builds are affected or whether any non-default setting is required. Machines where only trusted users log on carry less practical risk.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["10version1607","10version1809","10version21h2","10version22h2","11version23h2","windows10version1607","windows10version1809","windows10version21h2","windows10version22h2","windows11version23h2"],"ptokens":["10","11","1607","1809","21h2","22h2","23h2","version","windows"],"labels":["high","infrastructure","local","privilegeescalation","windows"],"campaign_type":null,"search_a":"'-119888':17A,20A '-2026':16A,19A '10':22A,26A,30A,34A '11':38A '1607':24A '1809':28A '21h2':32A '22h2':36A '23h2':40A 'audio':2A 'cve':15A,18A 'free':7A 'gain':12A 'higher':13A 'let':8A 'local':10A 'privileg':14A 'servic':3A 'use':5A 'use-after-fre':4A 'user':11A 'version':23A,27A,31A,35A,39A 'window':1A 'windows':21A,25A,29A,33A,37A","search_b":"'account':66B 'alreadi':62B 'attack':60B 'audio':56B 'condit':77B 'escal':45B 'exact':76B 'flaw':52B 'free':51B 'infrastructur':41B 'let':58B 'local':42B,65B 'privileg':44B,69B 'privilege-escal':43B 'rais':67B 'say':74B 'servic':57B 'sourc':71B 'trigger':78B 'use':49B 'use-after-fre':48B 'window':46B,55B","search_c":"'allow':86C 'attack':89C 'audio':84C 'author':88C 'elev':91C 'free':81C 'local':93C 'privileg':92C 'servic':85C 'use':79C 'window':83C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:20:08+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119888","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119888","severity":null,"published_at":"2026-11-10T19:20:08+00:00","modified_at":"2026-11-10T19:20:08+00:00","first_seen_at":"2026-11-10T19:25:01+00:00","fetched_at":"2026-11-10T19:25:01+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-119888:2982","url":"https://radar.offseq.com/threat/cve-2026-119888-cwe-416-use-after-free-in-microsoft-windows-10-version-1607-95667be76888b1c2","severity":null,"published_at":"2026-11-10T22:27:26+00:00","modified_at":"2026-11-10T22:27:26+00:00","first_seen_at":"2026-11-10T22:27:26+00:00","fetched_at":"2026-11-10T22:27:26+00:00","note":"MSRC page is JS-only and could not be read; affected builds and fixed builds taken from the Microsoft CNA data as mirrored by OffSeq (list shows 6 rows, fixed list says +8 more, so incomplete). Nothing verified. No exploitation or PoC found; not in KEV.","cites":["https://radar.offseq.com/threat/cve-2026-119888-cwe-416-use-after-free-in-microsoft-windows-10-version-1607-95667be76888b1c2","https://nvd.nist.gov/vuln/detail/CVE-2026-119888"]}],"documents":[{"id":119480,"url":"https://radar.offseq.com/threat/cve-2026-119888-cwe-416-use-after-free-in-microsoft-windows-10-version-1607-95667be76888b1c2","title":"OffSeq Threat Radar: CVE-2026-119888 (mirrors CNA data)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":119485,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119888","title":"NVD CVE-2026-119888","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}