Windows Telephony Service CVE-2026-62727

Exploitation requires an authenticated local session with at minimum a low-privilege (standard user) account on the target Windows system; this is confirmed by CVSS PR:L and AV:L. The Windows Telephony Service (TapiSrv) must be running - it is present and typically enabled by default on Windows installations supporting TAPI. The High attack complexity (AC:H) indicates that an attacker cannot reliably exploit this on the first attempt; successful exploitation depends on precise timing to win the concurrent resource access window, which may require multiple attempts or specific system load conditions. Exploitation is limited to local access only - remote, unauthenticated exploitation is not possible. No user interaction is required beyond the attacker's own actions (UI:N). Non-default or specially configured deployment scenarios are not required; default Windows installations with TapiSrv running are potentially vulnerable.

The CVSS base score of 7.0 with vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H accurately characterizes a moderate-to-high severity local privilege escalation. The High attack complexity (AC:H) is the primary risk mitigator: race condition exploitation is timing-dependent and typically requires repeated attempts or specific environmental conditions, reducing opportunistic exploitation compared to simpler memory-corruption or logic flaws. The local attack vector (AV:L) and requirement for a low-privilege account (PR:L) mean an attacker must already have a foothold on the target machine, limiting the exposure to post-compromise scenarios or insider threat. No EPSS data was provided, and the CVE is not present in CISA KEV, suggesting no confirmed widespread exploitation at time of analysis. No public proof-of-concept exploit code is referenced. The tags include 'Information Disclosure' alongside the privilege escalation vector; given the CVSS C:H/I:H/A:H, this likely reflects that sensitive data accessible to SYSTEM may be disclosed as a side effect of successful exploitation, not a separate, lower-severity path. In aggregate, this is a real priority for organizations with untrusted local users or compromised endpoints but is lower urgency than network-exploitable, low-complexity vulnerabilities.

An attacker who has already obtained a low-privilege local session on a Windows host - via phishing, credential theft, or an initial-access exploit - repeatedly triggers concurrent operations against the Windows Telephony Service to win the race condition timing window, substituting a privileged resource reference before the service validates it. Upon successfully winning the race, the attacker's code or payload executes in the context of the SYSTEM account, granting full control of the target host. No public proof-of-concept is available at time of analysis, but race condition exploits in Windows services are well-understood by advanced threat actors.