Windows Telephony Service CVE-2026-62724

Exploitation requires the attacker to have an active local authenticated session on the target Windows machine with at least low-privileged (standard user) credentials - confirmed by CVSS PR:L. The Windows Telephony Service must be running, which is its default state on Windows installations supporting TAPI; no non-default configuration is required to expose the vulnerable code path. High attack complexity (AC:H) indicates a race condition that demands precise timing between concurrent service operations, meaning exploitation is not deterministic and requires multiple attempts or environmental tuning. Exploitation is not automatable per SSVC (Automatable: no), ruling out worm-style or mass scripted attacks. Scope is unchanged (S:U), so exploitation is initially confined to the telephony service boundary before privilege elevation to SYSTEM. Remote network access alone is insufficient - physical or remote desktop/terminal session presence is required.

The CVSS base score of 7.0 with vector AV:L/AC:H/PR:L correctly captures the two primary risk moderators: local access requirement and high attack complexity, both of which substantially reduce real-world exploitability compared to network-vectored or low-complexity flaws. SSVC independently corroborates this - exploitation status is 'none,' automatable is 'no,' confirming that this cannot be reliably scripted for mass exploitation. However, SSVC's technical impact of 'total' signals that a successful exploitation chain is catastrophic, warranting patch priority even at medium-term risk tolerance. EPSS data is absent from the provided intelligence, leaving exploitation probability unquantified. KEV is not confirmed, and no public exploit code exists. Despite these moderating factors, the sheer breadth of affected platforms - from Windows 10 1607 (an extended-support-era release) through Windows Server 2025 - means exposure is widespread; even a mid-sized municipal IT team in leszno managing a heterogeneous Windows estate should treat this as an urgent patch cycle item, particularly for systems where standard users can establish local sessions. The CVSS high complexity and local vector do not eliminate risk in shared environments, terminal servers, or VDI deployments where lower-privileged users already have local access.

A local user with a standard Windows account interacts with the Windows Telephony Service through legitimate TAPI calls, deliberately timing requests to trigger a race condition between service threads freeing and dereferencing the same memory object. Upon successful corruption, the attacker redirects execution to attacker-controlled shellcode or a return-oriented programming chain within the service's elevated process context, obtaining SYSTEM-level privileges on the local machine. No public exploit code has been identified at time of analysis, and the high attack complexity (AC:H) means reliable exploitation likely requires tuning to the specific target OS build and hardware timing characteristics.