CVE-2026-49171
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
In Microsoft Windows Speech, a use-after-free vulnerability allows an authorized attacker to elevate privileges locally.
Risk Assessment
An authorized user can gain higher privileges, potentially leading to system compromise.
Recommendation
It is recommended to apply the security patch from Microsoft or disable the Windows Speech feature if not in use.
Other vulnerabilities in Microsoft Windows Speech
See all- CVE-2026-69531Medium
Unintended proxy or intermediary ('confused deputy') in Microsoft Windows Speech allows an authorized attacker to perform tampering locally.
- CVE-2026-69456High
Heap-based buffer overflow in Microsoft Windows Speech allows an authorized attacker to elevate privileges locally.
- CVE-2026-69444High
Heap-based buffer overflow in Microsoft Windows Speech allows an authorized attacker to elevate privileges locally.
Original NVD description (English source)
Use after free in Microsoft Windows Speech allows an authorized attacker to elevate privileges locally.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS