Windows Telephony Service EUVD-2026-35725

Attacker must already have an interactive or remote local session with at least low-privileged (standard user) credentials on the target Windows host, and the Telephony Service (TapiSrv) must be running and reachable from that session - the default on Windows, where the service is set to Manual (Trigger Start) and is activated by TAPI client calls. No user interaction is required from another user. Exploitation is meaningfully limited by high attack complexity (AC:H): the attacker must reliably win a timing race against the service, which typically requires multiple attempts, tuned thread/CPU pressure, and may be sensitive to core count and system load; remote network-only attackers without a local session cannot exploit this directly (AV:L).

Signals point to a credible but not top-tier priority. The CVSS vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H confirms local access with low privileges already held, no user interaction, and - importantly - high attack complexity, which is typical of race conditions that require precise timing to win. There is no CISA KEV listing and no public exploit identified at time of analysis, and no EPSS score was provided in the input, so widespread automated exploitation is not currently indicated. Note one tension in the data: the supplied tags include 'Information Disclosure', but both the description and the CVSS vector describe privilege elevation with C:H/I:H/A:H - the tag appears to under-represent the actual impact, and the CVSS/description should be trusted over the tag. This is a meaningful patch-cycle item for endpoints and especially multi-user systems (RDS hosts, VDI, shared workstations), but does not warrant out-of-band action absent new exploitation telemetry.

An attacker with valid low-privileged credentials - for example, a standard domain user who has phished or otherwise obtained access to a session on an RDS host - runs a local tool that repeatedly invokes a TAPI operation while concurrently mutating the shared resource the service relies on, racing to win the TOCTOU window. On a successful race, the Telephony Service performs a privileged action on attacker-controlled state, yielding SYSTEM-level code execution that the attacker uses to install persistence and pivot. The high attack complexity means the exploit may need many attempts and tuning per host, but race-condition exploits of this class have historically been productized into reliable LPE tools.