Windows Telephony Service CVE-2026-62725

Exploitation requires a valid local logon session on the target Windows host, meaning the attacker must already hold a low-privileged account (PR:L) - remote unauthenticated exploitation is not possible given AV:L. The Windows Telephony Service (tapisrv) must be in a running state; it is enabled by default on most Windows installations, so this is not a meaningful barrier on standard deployments. High attack complexity (AC:H) indicates a race condition or specific heap memory layout must be achieved, meaning exploitation is not trivially reliable and likely requires multiple attempts or a purpose-built heap-grooming primitive. Scope is unchanged (S:U), confining the direct impact to the local system. No user interaction is required. The primary limiting factors for defenders are: the requirement for pre-existing local access (limiting remote/unauthenticated attack paths) and the AC:H constraint (reducing reliability of one-shot exploitation without tailored tooling).

The CVSS 7.0 score (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) faithfully captures a meaningful but operationally constrained threat. The high attack complexity (AC:H) is the critical limiting factor - successful exploitation likely requires winning a race condition or achieving a specific heap layout, reducing reliability for opportunistic actors. The unchanged scope (S:U) bounds impact to the local system, ruling out direct lateral movement via this bug alone. No CISA KEV listing is present, meaning active exploitation is not confirmed; no POC code is identified in the input data. However, the breadth of affected platforms - spanning over a decade of Windows releases, including still-common Windows 10 22H2 and Windows Server 2019/2022 - substantially expands aggregate exposure. In post-compromise or insider-threat scenarios where an attacker already holds a low-privileged local session, this vulnerability becomes a practical privilege escalation step toward SYSTEM. The 'Denial of Service' tag suggests the UAF may also manifest as a service crash, adding an availability risk dimension. EPSS data was not provided; exploitation probability is assessed as moderate given AC:H and absence of public exploit code.

A low-privileged attacker - or malware executing under a standard user account after a phishing compromise - issues a crafted sequence of TAPI client API calls to the Telephony Service. The calls manipulate the service's heap to trigger a use-after-free condition; the attacker then times or races a subsequent operation to reclaim the freed memory with controlled data, redirecting execution flow within the privileged tapisrv process. The result is arbitrary code execution as SYSTEM, granting full administrative control over the host with no further interaction required.