CVE-2026-70307

Think of this as a mistake in Windows network support code where memory gets reused after it has already been freed. If someone already has a foothold as a low-permission user on the machine, they may be able to trigger a crash and turn that into full control of the computer—like breaking out of a locked room because the lock’s internal mechanism was mishandled.

This matters if you run Windows 10, Windows 11, or Windows Server (2012, 2012 R2, 2016, 2019, 2022, or 2025) with local user accounts that aren’t fully trusted. The risk is tied to an attacker having local credentials with low/basic permissions; it’s reachable in default configuration and does not require user interaction, but it is not a “remote-only” issue.

Only becomes a practical risk if an attacker can log on locally (for example: a stolen account, an overly-permissive local user, or an insider).

This is RED because it is a local privilege escalation to full system control, and it’s reachable in the default configuration. Even though there’s no clear dated public exploitation report in the findings, the flaw is serious and Microsoft has already provided fixed builds for a wide range of Windows and Windows Server versions.

Treat this as a high-priority patching item, especially on machines where local accounts may be exposed to theft or misuse.