CVE-2026-32089

CVE-2026-32089 is a use-after-free vulnerability in the Windows Speech Brokered API that permits authorized local users to escalate their privileges on affected Windows systems. The vulnerability resides in memory management within the Speech Brokered API component, which is a core Windows service. The vulnerability presents HIGH severity with a CVSS score of 7.8, reflecting a local attack vector with low complexity and no user interaction required. An attacker with low privileges can exploit this flaw to gain high-level access, compromising confidentiality, integrity, and availability of the system. There is currently no evidence of active exploitation in the wild, as the vulnerability does not appear on the Known Exploited Vulnerabilities (KEV) catalog and is listed as inactive on threat tracking lists. The EPSS probability of exploitation is extremely low at 0.00044, and the FAUCET risk score of 39.0 indicates moderate concern. Community attention and public exploit code availability appear limited at this time.