Windows Telephony Service CVE-2026-34338

Exploitation requires the attacker to already have local, authenticated code-execution on the target (CVSS PR:L), i.e., a valid low-privileged user session; it cannot be triggered remotely or unauthenticated. The vulnerable Windows Telephony Service (TapiSrv) must be present and reachable by the caller, which is the default on the listed Windows client and server builds. No user interaction is needed (UI:N). Limiting factors that reduce realistic risk: the attacker needs an existing foothold, the exploit depends on winning a use-after-free timing/heap-grooming race (reflected in SSVC 'Automatable: no' and EPSS 0.04%), and hosts already updated to the fixed builds above are not affected.

Signals are largely consistent and point to a genuine but non-emergency patch priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8 High) indicates local access with low privileges and no user interaction, yielding full confidentiality, integrity and availability impact - corroborated by SSVC 'Technical Impact: total'. Countervailing signals lower real-world urgency: EPSS is only 0.04% (13th percentile), SSVC 'Exploitation: none' and 'Automatable: no', and no public exploit is identified. The low EPSS and 'not automatable' rating are expected for a local UAF EoP that requires an already-authenticated foothold and non-trivial heap grooming, so this is a real priority for privilege-boundary hardening but not a drop-everything internet-facing threat. Note a minor tagging inconsistency: the input tags include 'Denial Of Service', yet the CVSS models full C/I/A impact and the description states privilege elevation - treat the primary impact as EoP to SYSTEM, with DoS a plausible secondary outcome of memory corruption.

An attacker who already has a low-privileged foothold on a Windows host - for example a standard user account obtained through phishing or a compromised service - runs a crafted local program that drives the Telephony Service into freeing and then reusing a heap object, reclaiming that memory with controlled data. By winning the use-after-free race, the attacker corrupts service state to execute code in the SYSTEM context and fully compromises the machine. No public exploit is identified at time of analysis, and the local vector plus non-automatable rating imply a targeted, hands-on-keyboard scenario rather than mass exploitation.