CVE-2026-34328

What it actually does

CVE-2026-34328 is a local information disclosure vulnerability in the Windows Audio Service. An attacker who already has valid local code execution with low privileges can interact with the affected service and cause it to expose sensitive information that should not be accessible to that user. The CVSS vector indicates local attack requirements, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, and no direct integrity or availability impact.

Why it matters to the business

Successful exploitation could allow a local user or malware running under a low-privileged account to obtain sensitive information from a Windows workstation or server. The primary business risk is confidentiality loss, which may support follow-on attacks such as credential theft, privilege escalation research, lateral movement, or data exposure. This is not currently listed in CISA KEV, has no known public exploit maturity, and has a low EPSS score with a flat 30-day trend, so broad opportunistic exploitation appears unlikely at this time; however, affected Windows desktop and server versions are widely deployed, making timely patching still important.

How an attack unfolds

An attacker first needs local access to an affected Windows system, typically through an existing foothold such as malware execution, stolen user credentials, physical access, or compromise of a low-privileged account. Once running locally, the attacker interacts with the Windows Audio Service or related service interfaces in a way that triggers the improper information exposure condition. The service then returns or leaks information that the attacker's current security context should not be able to read. The attacker can use the disclosed information directly or combine it with other vulnerabilities and post-exploitation techniques to deepen access. There is currently no indication from the provided intelligence that this vulnerability is being exploited in the wild or used by named threat actors or ransomware campaigns.

How to fix it

Apply the relevant Microsoft security update for the affected Windows version through Windows Update, Microsoft Update Catalog, WSUS, Microsoft Intune, Configuration Manager, or another enterprise patching mechanism. Because no fixed build numbers were provided, use Microsoft's official advisory and update channels to identify the applicable cumulative update for Windows 10 1809, 21H2, 22H2; Windows 11 23H2, 24H2, 25H2, 26H1; Windows Server 2019, 2022, and 2025. If immediate patching is not possible, reduce exposure by limiting local interactive access, removing unnecessary local administrator rights, enforcing least privilege, hardening endpoint controls, and monitoring for suspicious local service interaction. Disabling audio-related services may reduce attack surface in limited server use cases, but should be tested carefully because it may disrupt expected functionality and is not a substitute for patching.

How to confirm the fix worked

Confirm that each affected Windows asset has installed the Microsoft cumulative update or security update that supersedes the vulnerable version. Validate through centralized patch-management reports, Windows Update history, Microsoft Defender Vulnerability Management, Configuration Manager, Intune, or authenticated vulnerability scanning. On individual systems, review installed hotfixes and build numbers using supported administrative tools such as Settings, Windows Update history, winver, systeminfo, Get-HotFix, or enterprise inventory. Confirm that vulnerability scanners no longer report CVE-2026-34328 on Windows 10, Windows 11, and Windows Server assets. Where a compensating control was used, verify that local access is restricted and that the Windows Audio Service exposure is not reachable by unauthorized local users.

Typical attack path

1. Obtain local execution on an affected Windows workstation or server as a low-privileged authenticated user.
2. Identify that the target is running a vulnerable Windows version and that the Windows Audio Service or related components are present.
3. Invoke the vulnerable local service interaction that causes unauthorized information disclosure.
4. Collect sensitive information exposed by the service.
5. Use the disclosed information to support follow-on activity such as credential access, privilege escalation attempts, lateral movement, or targeted data discovery.

How to detect it

Because this is a local information disclosure vulnerability and no public exploit details, known malware signatures, threat actors, or KEV exploitation are identified in the provided intelligence, detection should focus on signs of local post-exploitation rather than a single definitive indicator. Review Windows Security logs, Sysmon or EDR telemetry, service-control events, process creation events, and Windows Audio Service activity for unusual access patterns by low-privileged users or suspicious binaries. Useful log sources include Windows Security Event ID 4688 for process creation, Sysmon Event ID 1 for process creation, Sysmon Event ID 10 for process access, Sysmon Event ID 11 for file creation, and service-related events from the System log and Service Control Manager. Look for unexpected processes interacting with audiosrv, svchost instances hosting audio services, audio endpoint components, or service-control utilities shortly after an initial compromise. Correlate any suspected activity with other signs of compromise such as newly created local users, suspicious scheduled tasks, credential dumping tools, anomalous RDP logons, unsigned executables in user-writable directories, or privilege escalation attempts. Absence of these artifacts does not prove the vulnerability was not exploited, because information disclosure may leave minimal forensic evidence.

• Service Name: Audiosrv
• Windows Audio
• AudioEndpointBuilder
• svchost.exe -k LocalServiceNetworkRestricted
• sc.exe query Audiosrv
• sc.exe qc Audiosrv
• sc.exe stop Audiosrv
• sc.exe start Audiosrv
• powershell.exe Get-Service Audiosrv
• Event ID 4688
• Sysmon Event ID 1
• Sysmon Event ID 10
• Service Control Manager

What your security team should do

• Prioritize patching broadly deployed Windows endpoints and multi-user Windows Server systems, especially systems where untrusted or low-privileged users can log on locally or via remote desktop.
• Use enterprise patch tooling to identify affected Windows 10, Windows 11, Windows Server 2019, Windows Server 2022, and Windows Server 2025 assets and deploy the applicable Microsoft cumulative updates.
• Treat this as a confidentiality-focused local post-exploitation risk rather than a remote-entry vulnerability; prioritize it behind actively exploited or remotely exploitable critical issues if patch capacity is constrained.
• Review endpoint telemetry for unusual local interaction with Windows Audio Service processes, especially by nonstandard user processes or recently dropped executables.
• Maintain least-privilege controls, remove unnecessary local admin rights, and restrict local/RDP access to reduce the usefulness of this vulnerability to attackers with an initial foothold.
• Continue monitoring Microsoft guidance, threat intelligence, and CISA KEV updates in case exploit maturity changes.