CVE-2026-70134 introduces a use‑after‑free condition in the Windows Event Tracing subsystem. The flaw arises from improper handling of freed memory buffers and is classified as CWE-416. According to the description, an authorized local attacker can exploit this defect to raise privileges on the victim machine, potentially compromising system integrity and confidentiality for the affected services.

The vulnerability affects Microsoft Windows 10 Versions 1809, 21H2, and 22H2; Windows 11 Versions 23H2, 24H2, 25H2, 26H2, 26H1; and Windows Server 2019, Server Core, 2022, and 2025 versions, including server core installations.

The CVSS score of 7 indicates a high severity, and the EPSS score is not available, which means the current exploitation probability is unknown. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that the attack vector is local, requiring an authorized user to trigger the faulty event tracing code. Given this local privilege escalation potential, the risk is significant for environments where privileged services rely on Event Tracing and where user accounts have administrative privileges.