Windows Telephony Service CVE-2026-62701

Attacker must have a low-privileged local user account on the target Windows system (PR:L per CVSS vector) - remote unauthenticated exploitation is not possible for this vulnerability. The Windows Telephony Service (TapiSrv) must be running; it is enabled by default on Windows desktop and server editions. No user interaction is required after initial local access is established. Exploitation is limited to: (1) local or terminal-session access - no network path exists to trigger this remotely, and (2) the specific affected build ranges per platform; systems patched to the fixed build numbers listed in the EUVD data are not vulnerable. There is no requirement for a specific non-default configuration - the Telephony Service runs in default Windows installations.

The CVSS 7.8 score with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H reflects a high-severity local privilege escalation: low attack complexity, no user interaction, and full compromise of confidentiality, integrity, and availability once exploited. Real-world risk is elevated because LPE vulnerabilities are routinely chained after initial access (phishing, web exploit, credential theft) to achieve full system compromise. The broad affected version range - spanning Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025 - amplifies aggregate exposure across enterprise fleets. No EPSS score was provided in the source data, and the vulnerability is not listed in the CISA KEV catalog at time of analysis, indicating no confirmed active exploitation. The 'Denial Of Service' tag alongside 'Memory Corruption' and 'Use After Free' suggests the crash path may be simpler to trigger than full code execution, which could lower the exploitation bar. No conflicting signals between CVSS vector and description - local vector is consistent with a TAPI service flaw requiring local process interaction.

A threat actor who has obtained a standard user shell on a target Windows system - via phishing, a web browser exploit, or compromised credentials - crafts a sequence of TAPI API calls designed to trigger the use-after-free condition in the Telephony Service. By timing the calls to control heap layout, the attacker overwrites freed memory with attacker-supplied data, redirecting service execution to shellcode or a ROP chain running under the SYSTEM account, completing a full privilege escalation. No public exploit identified at time of analysis, but the low attack complexity rating (AC:L) suggests the memory corruption primitive is reliably triggerable.