Description
Use after free in Microsoft Windows Speech allows an authorized attacker to elevate privileges locally.
Published: 2026-07-14
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A use‑after‑free flaw in the Windows Speech Runtime allows an authenticated local user to invoke code that receives higher privileges. The vulnerability is classified as CWE‑416 and results in the attacker gaining administrative level access, enabling the compromise of system confidentiality, integrity, or availability.

Affected Systems

The flaw affects Microsoft Windows 10 versions 1607 to 22H2 on both x86 and x64, Windows 11 versions 24H2 to 26H1 on ARM64 and x64, and all Windows Server releases 2016 through 2025, including Server Core installations. The issue resides solely in the Windows Speech component.

Risk and Exploitability

The CVSS score of 7.5 marks the vulnerability as high severity, yet the EPSS score is below 1%, indicating a low current exploitation likelihood. It is not listed in CISA KEV. Based on the description, it is inferred that the attack requires local authentication and execution of the speech service, after which the use‑after‑free can be triggered to elevate to system level privileges.

Generated by OpenCVE AI on August 1, 2026 at 09:52 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the Microsoft security update for CVE‑2026‑49171 via Windows Update or the Microsoft Security Response Center as soon as it becomes available.
  • If speech services are not required, uninstall or disable the Windows Speech component to reduce the attack surface.
  • Restrict access to speech services to the minimum necessary accounts and enforce least‑privilege policies.

Generated by OpenCVE AI on August 1, 2026 at 09:52 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 15 Jul 2026 12:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 14 Jul 2026 17:15:00 +0000

Type Values Removed Values Added
Description Use after free in Microsoft Windows Speech allows an authorized attacker to elevate privileges locally.
Title Windows Speech Runtime Elevation of Privilege Vulnerability
First Time appeared Microsoft
Microsoft windows 10 1607
Microsoft windows 10 1809
Microsoft windows 10 21h2
Microsoft windows 10 22h2
Microsoft windows 11 24h2
Microsoft windows 11 25h2
Microsoft windows 11 26h1
Microsoft windows Server 2016
Microsoft windows Server 2019
Microsoft windows Server 2022
Microsoft windows Server 2025
Weaknesses CWE-416
CPEs cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_21H2:*:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_22H2:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_11_24H2:*:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_11_25H2:*:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_11_26H1:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*
Vendors & Products Microsoft
Microsoft windows 10 1607
Microsoft windows 10 1809
Microsoft windows 10 21h2
Microsoft windows 10 22h2
Microsoft windows 11 24h2
Microsoft windows 11 25h2
Microsoft windows 11 26h1
Microsoft windows Server 2016
Microsoft windows Server 2019
Microsoft windows Server 2022
Microsoft windows Server 2025
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C'}

Subscriptions

Microsoft Windows 10 1607 Windows 10 1809 Windows 10 21h2 Windows 10 22h2 Windows 11 24h2 Windows 11 25h2 Windows 11 26h1 Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows Server 2025
cve-icon MITRE

Status: PUBLISHED

Assigner: microsoft

Published:

Updated: 2026-07-30T20:22:13.664Z

Reserved: 2026-05-27T23:44:09.623Z

Link: CVE-2026-49171

cve-icon Vulnrichment

Updated: 2026-07-15T10:44:22.983Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-01T10:00:04Z

Weaknesses