MicrosoftCVE-2026-50440

Microsoft Windows Audio Service: race condition

CVE-2026-50440 · Published Jul 14, 2026 · updated Jul 23, 2026

High7.8

Fix: upgrade to 10.0.26100.8875 or later (3 fixed versions below)

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Audio Service allows an authorized attacker to elevate privileges locally.

Affected versions

Package	Affected	Fixed in
Windows 11 Version 24H2 Product	>= 10.0.26100.0, < 10.0.26100.8875	10.0.26100.8875
Windows 11 Version 25H2 Product	>= 10.0.26200.0, < 10.0.26200.8875	10.0.26200.8875
Windows 11 version 26H1 Product	>= 10.0.28000.0, < 10.0.28000.2525	10.0.28000.2525

Details and references

CVSS 3.1: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity from: the vendor (its own CVE record or advisory)
Weakness: CWE-362, CWE-416

More Microsoft advisories

All Microsoft

HighJul 14

Secret exfiltration vulnerabilityCVE-2026-47282fixed in 1.128.1 HighJul 14

Workspace Trust Security Feature Bypass VulnerabilityCVE-2026-57101fixed in 1.128.1 HighJul 14

Remote Code Execution VulnerabilityCVE-2026-57102fixed in 1.128.1 High 7.8Jul 14

Microsoft .NET 8.0 runtime: unsafe deserializationCVE-2026-50649fixed in 8.0.29 +9 High 7.8Jul 14

Microsoft .NET 8.0 runtime: code injectionCVE-2026-50650fixed in 8.0.29 +10 High 7.5Jul 14

Microsoft .NET 10.0 runtime: resource exhaustionCVE-2026-50651fixed in 10.0.10 +5