Windows Telephony Service CVE-2026-40382

The attacker must already have local, authenticated access at low privilege (PR:L) on the target Windows system and the ability to interact with the Windows Telephony Service (TapiSrv), which is present and reachable by default on supported Windows client and server installations. No user interaction is required (UI:N) and attack complexity is low (AC:L). Exploitation is limited by the need for pre-existing local access - it cannot be performed remotely or unauthenticated - and by any environment that has disabled or removed the Telephony service. SSVC rates the flaw as not automatable, indicating exploitation requires deliberate, targeted action rather than opportunistic mass scanning.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.8) describes a local, low-complexity attack requiring only low existing privileges and no user interaction, yielding full confidentiality, integrity, and availability impact - a classic reliable local EoP profile. SSVC corroborates 'total' technical impact but rates exploitation as 'none' and automatable as 'no', consistent with the very low EPSS score (0.04%, 13th percentile) and the absence from CISA KEV. These signals align rather than conflict: the bug is genuinely high-impact if exploited but is not currently being exploited and is not trivially wormable, so it belongs in routine-but-prompt patch cycles rather than emergency response. Note the tag set lists 'Denial Of Service' alongside 'Use After Free', which is narrower than the description's privilege-elevation framing; the CVSS integrity/confidentiality impact and the EoP description should be treated as authoritative over the DoS tag. As a memory-corruption EoP in a Windows service, it is a plausible future component in post-compromise exploit chains even if standalone risk today is moderate.

An attacker who has already obtained low-privileged code execution on a Windows host (for example via phishing, a compromised service account, or a standard user login) invokes the Telephony Service through its local RPC interface and triggers the use-after-free by manipulating object lifetime, grooming the freed allocation to hijack the dangling pointer and execute code at SYSTEM. Because AV:L/AC:L and no user interaction are required, exploitation is reliable in principle, but no public exploit is identified at time of analysis, so a bespoke exploit would need to be developed.