Windows Telephony Service EUVD-2026-35728

Exploitation requires a local, authenticated session with at minimum standard user (low-privilege) rights on the target system, as confirmed by CVSS AV:L/PR:L. The attacker must be able to invoke the Windows Telephony Service API, which is present by default on standard Windows installations - no non-default configuration or special feature enablement appears to be required based on available data. No victim interaction is needed (UI:N). Exploitation is strictly limited to local access: remote unauthenticated or even remote authenticated exploitation is not possible per the CVSS local attack vector. The SSVC 'automatable: no' rating further indicates the attack cannot be scripted for mass exploitation at scale. Limiting factors for defenders: physically restricted systems, VDI or jump-server environments where local user accounts are tightly controlled, and systems where tapisrv is disabled present minimal exposure.

The CVSS 5.5 Medium score reflects a constrained impact profile: local-only attack vector, low privilege requirement, no integrity or availability impact, and confidentiality impact scoped to the local process (S:U). SSVC corroborates this - exploitation status is 'none', the attack is not automatable, and technical impact is 'partial', suggesting defenders can apply this patch in a standard patch cycle rather than emergency response. EPSS data was not provided in the source intelligence, so statistical exploitation probability cannot be quoted; this gap should be noted when triaging. The vulnerability is not listed in CISA KEV, and no public exploit code has been identified at time of analysis. The 'none' SSVC exploitation status and absence from KEV are consistent signals: this is a real confidentiality risk on multi-user or shared-access Windows systems where untrusted local users are present, but it is not an urgent emergency for most enterprise environments. The primary real-world concern is privilege escalation pipelines - an information disclosure of this type can leak memory pointers or tokens that feed a second-stage exploit, so its true risk may be higher in chained attack scenarios than the standalone CVSS score implies.

A standard user logged into an unpatched Windows workstation or server calls into the Windows Telephony Service API with a specially crafted request designed to trigger an out-of-bounds read at a calculable memory offset. The service reads beyond the buffer boundary and returns adjacent memory contents - potentially exposing heap data including authentication tokens, cryptographic material, or pointer values. If those pointers are used in a follow-on exploit stage, this information disclosure becomes a stepping stone in a local privilege escalation chain. No public exploit code has been identified at time of analysis.