CVE-2026-70307

Think of this as a mistake in Windows network support code where memory gets reused after it has already been freed. If someone already has a foothold as a low-permission user on the machine, they may be able to trigger a crash and turn that into full control of the computer—like breaking out of a locked room because the lock’s internal mechanism was mishandled.

This matters if you run Windows 10, Windows 11, or Windows Server (2012, 2012 R2, 2016, 2019, 2022, or 2025) with local user accounts that aren’t fully trusted. The risk is tied to an attacker having local credentials with low/basic permissions; it’s reachable in default configuration and does not require user interaction, but it is not a “remote-only” issue.

Only becomes a practical risk if an attacker can log on locally (for example: a stolen account, an overly-permissive local user, or an insider).

This is RED because it is a local privilege escalation to full system control, and it’s reachable in the default configuration. Even though there’s no clear dated public exploitation report in the findings, the flaw is serious and Microsoft has already provided fixed builds for a wide range of Windows and Windows Server versions.

Treat this as a high-priority patching item, especially on machines where local accounts may be exposed to theft or misuse.

1. Identify exposure on each device

   • Determine your exact Windows product and build number.
   • Confirm whether the device is one of the affected products: Windows 10, Windows 11, Windows Server 2012, Windows Server 2012 R2, Windows Server 2016, Windows Server 2019, Windows Server 2022, Windows Server 2025.

2. Check against the fixed versions (per OS line)

   • Windows 10 fixed in: 10.0.14393.9418; 10.0.17763.9121; 10.0.19044.7663; 10.0.19045.7663
   • Windows 11 fixed in: 10.0.22631.7517; 10.0.26100.9168; 10.0.26200.9168; 10.0.28000.2704
   • Windows Server 2012 fixed in: 6.2.9200.26280
   • Windows Server 2012 R2 fixed in: 6.3.9600.23338
   • Windows Server 2016 fixed in: 10.0.14393.9418
   • Windows Server 2019 fixed in: 10.0.17763.9121
   • (For Windows Server 2022 and 2025, use the CVE’s Microsoft Update Guide links to confirm the exact fixed build for your update branch, since the provided findings list explicit fixed builds for the other server lines.)

3. Patch

   • Install the Microsoft security update for CVE-2026-70307 from the Microsoft Update Guide page.
   • After updating, re-check the device build number to confirm it is at or above the fixed version for your OS line.

4. Temporary risk reduction if patching is delayed

   • Remove or disable unnecessary local user accounts.
   • Enforce least privilege so local users don’t have more access than needed.
   • Review whether any shared/local accounts exist and whether password handling is strong (since the attacker must have local credentials).

5. What to monitor

   • Look for signs of local account compromise (new logins, unusual session activity, unexpected privilege changes) because the attacker’s prerequisite is local credential access.

CISA KEV timing

• The findings indicate this CVE is not listed in CISA KEV, and no dated exploitation claim is provided in the findings.

Severity and type: This is a local privilege escalation (CWE-416) affecting Windows network-related driver code (Windows Ancillary Function Driver for WinSock). The mechanism described in the findings is reuse of released memory that can crash the target and enable full control of the system.

Reachability and prerequisites: The findings state it is reachable in default configuration and requires low authentication (a local user credential) with no user interaction required. That makes the main risk path “attacker already has local access.”

Exploitation status: The findings report no clear dated exploitation claim and no public exploit code on record, and KEV is not listed. However, the traffic-light verdict for this CVE is already RED, reflecting the impact (full takeover) and seriousness.

Patch availability: Microsoft has fixed specific builds across multiple Windows 10/11 and Windows Server lines (examples provided in the findings). Use the Microsoft Update Guide page for your exact OS/update branch.

Actor note: The findings include press attention tied to the Lazarus group, but they do not provide a dated incident specific to CVE-2026-70307 in the provided digests.