Windows Telephony Service CVE-2026-50669

Exploitation requires the attacker to already have local, authenticated access with at least low privileges (PR:L) on an affected Windows host and the ability to execute code that issues concurrent requests to the Windows Telephony Service; no user interaction is needed (UI:N). The key limiting factor is the race condition itself (AC:H): success depends on winning a precise timing window against a shared resource, so exploitation is not guaranteed on a single attempt and may require repeated tries. It cannot be launched remotely without an existing local foothold (AV:L), which meaningfully constrains real-world risk to environments where untrusted users or code already run locally.

The CVSS 3.1 base score of 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) describes a genuine but non-trivial threat: an attacker already needs local access and low privileges (PR:L), and must overcome high attack complexity (AC:H) - the hallmark of a race condition that requires precise timing and may not win on the first attempt. The upside for an attacker is severe, with high confidentiality, integrity, and availability impact (full host compromise / SYSTEM-level escalation). No EPSS score, KEV listing, or POC was supplied, so there is no evidence of active or imminent exploitation; the AC:H rating further lowers the odds of reliable mass exploitation. Note a signal conflict to verify: the vendor Tags label this 'Information Disclosure,' yet the description and CVSS both describe privilege elevation with full C/I/A impact - treat the tag as imprecise and rely on the description and vector. Overall this is a standard 'patch in the normal cycle' local EoP: real, but lower urgency than a wormable or network-facing critical.

A low-privileged user or malware already running on a host (for example after phishing or via an unprivileged service account) repeatedly issues concurrent requests to the Windows Telephony Service to trigger the synchronization flaw. By winning the race, the attacker corrupts privileged state and escalates to SYSTEM-level rights, then disables defenses or moves laterally. No public POC was identified, and the AC:H rating means the attacker likely needs many timing attempts to succeed.