Windows Telephony Service CVE-2026-42825

Requires the attacker to already have local, authenticated low-privileged access to the target Windows host (PR:L, AV:L) and the ability to make calls into the Windows Telephony Service (TapiSrv), which is present by default across affected Windows client and server builds. No user interaction is needed (UI:N). Exploitation is limited by high attack complexity (AC:H): success depends on winning a memory-timing race to reclaim the freed object, which is not reliably automatable per CISA SSVC (Automatable: no). Limiting factors for defenders: an attacker cannot use this remotely or without an existing account, and hosts where the Telephony service is disabled remove the reachable code path.

Signals converge on real-but-not-urgent priority. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0) shows local vector, high attack complexity, and required low privileges, but total (High) impact on confidentiality, integrity, and availability once triggered. SSVC agrees: Exploitation=none, Automatable=no, Technical Impact=total - meaning no observed exploitation and no reliable one-shot automation (consistent with the AC:H race condition), but full control if it works. EPSS is very low (0.04%, 12th percentile) and there is no KEV listing and no POC, so near-term mass exploitation is unlikely. The signals are internally consistent - nothing contradicts the local, complex, privileged-user profile. The realistic risk is as a chained escalation step for an attacker who already has a foothold; the tags include 'Denial Of Service' alongside 'Use After Free', which fits a UAF that may crash the service (availability) as well as escalate.

An attacker who has already gained low-privileged code execution on a Windows host - for example through a phishing payload or a compromised standard user account - invokes crafted Telephony Service calls to free an object and then race-reallocate the freed memory with controlled data. By winning the timing window (AC:H), they trigger the use-after-free to execute code in the service's privileged context and escalate from standard user toward SYSTEM. No public exploit is identified at time of analysis, so this would require custom development of the race.