Windows Telephony CVE-2026-62723

Exploitation requires an authenticated local session on the target Windows host - the CVSS vector PR:L confirms a low-privileged user account is sufficient, and the description explicitly states 'authorized attacker,' meaning anonymous or unauthenticated remote exploitation is not possible. The attack vector is strictly local (AV:L), so network-only access does not enable exploitation without prior code execution or a valid interactive/remote desktop session. The Windows Telephony Service (TAPI) must be running on the target system - environments that have explicitly disabled TAPI are not exposed. High attack complexity (AC:H) limits exploitation: the attacker must win a race condition or achieve a precise heap state, which reduces reliability and rules out automated mass exploitation. Exploitation is not limited to any single Windows version - the flaw spans client and server SKUs from Windows Server 2012 through Windows 11 26H1.

The CVSS 3.1 base score of 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects a meaningful but non-trivial local escalation primitive. The attack vector is strictly local, meaning remote exploitation is not directly possible - an attacker must have an existing foothold with at least a low-privileged user account. The high attack complexity (AC:H) is the primary risk-reducing factor, indicating that exploitation likely requires precise timing, heap spray, or race condition control rather than a simple, reliable trigger. No EPSS probability data was provided in the source intelligence, and neither a public proof-of-concept nor a CISA KEV listing is present, suggesting this is not currently under widespread active exploitation. Despite the high C/I/A impact triad - which reflects post-exploitation SYSTEM-level access - the real-world priority should be calibrated to environments where attackers may already have local foothold access (e.g., shared servers, RDS/Citrix environments, organizations facing insider threat), where a reliable exploit would be highly impactful. For isolated workstations with no known compromise, this is a standard patch-cycle priority rather than emergency response.

An attacker who has compromised or legitimately holds a standard Windows user account on a target server - for example, a low-privileged RDS or Citrix session user - triggers a use-after-free condition in the Windows Telephony Service by crafting specific TAPI API calls that manipulate heap memory timing, causing a freed object to be reused with attacker-controlled data. Upon successful heap manipulation under the high-complexity constraint (likely requiring multiple attempts or a precise race window), the attacker redirects execution to shellcode or a ROP chain, escalating from a standard user to SYSTEM-level privileges. No public proof-of-concept has been identified at time of analysis.