A null pointer dereference in the Windows Audio Service can cause the service to read data from memory it does not own, potentially exposing sensitive local information. This weakness is tied to CWE‑476, which describes a null pointer reference that can lead to improper handling of memory. The impact is a compromise of confidentiality for data that the vulnerable service can access locally, without affecting system integrity or availability directly.

Microsoft Windows 10 (versions 1607, 1809, 21H2, 22H2), Windows 11 (versions 23H2, 24H2, 25H2, 26H2, 26H1) and Windows Server (2012, 2012 R2, 2016, 2019, 2022, 2025) on both full and Server Core installations.

The CVSS score of 5.5 indicates a moderate severity. The EPSS score is listed as < 1 %, signaling that, as of now, public exploitation is unlikely. The vulnerability is not listed in the CISA KEV catalog, meaning no known widespread exploitation. The description states that only an authorized attacker can trigger the issue, implying that the attacker must have local access to the affected system. Based on this wording, it is inferred that the attacker requires some level of local privilege to interact with or influence the Audio Service, though specific privileges are not detailed. An attacker that can cause the Audio Service to dereference a null pointer could potentially read local memory contents, thereby weakening confidentiality for the system’s local user data.