Windows Telephony Service CVE-2026-62726

Exploitation requires the attacker to hold an active, authenticated local session on the target system with at minimum low-privilege user rights, as indicated by AV:L and PR:L in the CVSS vector; remote unauthenticated exploitation is not possible. The Windows Telephony Service (TapiSrv) must be running on the target, which is its default state on most Windows client and server installations. High attack complexity (AC:H) indicates that reliable exploitation likely requires precise heap manipulation or race-condition timing, meaning this is not a trivially automatable technique. Exploitation is bounded to post-access privilege escalation - the attacker must first obtain local code execution through a separate mechanism, making this a chaining vulnerability rather than an initial access vector. Limiting factors include the requirement for an existing local foothold and the non-trivial exploitation complexity that reduces reliability across diverse memory layouts.

The CVSS 7.0 base score with vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H reflects a meaningful but operationally constrained risk profile: local access and high attack complexity substantially reduce opportunistic or automated exploitation. No EPSS score was supplied in the available data, so exploitation probability cannot be independently quantified. This CVE does not appear in CISA KEV, and no public proof-of-concept exploit has been identified, which further limits near-term mass-exploitation risk. Despite these moderating factors, the breadth of affected Windows versions - from legacy Server 2012 R2 through the current Windows 11 26H1 - means virtually every Windows-running organization is exposed until patched, and even a mid-sized municipal IT team in koszalin running mixed-vintage infrastructure should treat this as a standard patch-cycle priority rather than a deferred item. Secondary impacts noted in the tags include denial-of-service alongside privilege escalation. The AC:H constraint mitigates spray-and-pray scenarios but does not protect against a determined post-access threat actor already holding a foothold on the system.

An attacker who has obtained a low-privileged local session on a vulnerable Windows system - for example, via phishing or an initial access vulnerability - sends crafted requests to the Windows Telephony Service to trigger a use-after-free condition by manipulating object lifecycle timing within the service. Using heap grooming techniques to control the reallocated memory region, the attacker redirects execution flow inside the elevated TapiSrv process and achieves SYSTEM-level code execution. No public proof-of-concept exploit has been identified at time of analysis, but UAF exploitation in privileged Windows services is a well-documented technique within the threat actor community.