Windows Telephony Service EUVD-2026-56320

The attacker must hold a valid, low-privileged local account or process on the target Windows system (CVSS PR:L, AV:L) - unauthenticated or remote-only attackers cannot exploit this vulnerability directly. The Windows Telephony Service (TAPISRV) must be running, which is its default state on standard Windows installations that include telephony components; exploitation is blocked on systems where the service has been explicitly disabled. No user interaction is required (UI:N). Exploitation is strictly limited to local attack vectors - remote unauthenticated exploitation is not possible per the confirmed CVSS vector. Systems running EOL versions (Server 2012, Server 2012 R2) where Microsoft Extended Security Updates are unavailable face elevated residual risk after the patch window closes.

The CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately characterizes a local privilege escalation with low attack complexity and no user interaction required. The local attack vector is the primary limiting factor: an attacker must already have low-privilege code execution on the target host. However, AC:L and UI:N mean that once that foothold exists, exploitation is reliable and fully attacker-controlled - this is not a race condition or probabilistic attack. No EPSS score was provided, so exploitation probability cannot be quantified numerically. KEV status is not confirmed, and no public POC has been identified, suggesting exploitation has not yet been observed at scale. The real-world priority is high for any organization where users or services can obtain local interactive or scripted access on shared systems (e.g., terminal servers, VDI environments, developer workstations), as this vulnerability provides reliable SYSTEM-level escalation. The breadth of affected Windows versions - from EOL Server 2012 through current Server 2025 - significantly widens organizational exposure.

An attacker who has obtained low-privilege access to a Windows host - for example, through a phishing-delivered payload, a compromised service account, or exploitation of a separate remote vulnerability - crafts a malformed TAPI request and submits it to the local Telephony Service. The heap buffer overflow corrupts adjacent heap structures within TAPISRV, allowing the attacker to redirect execution and achieve SYSTEM-level privileges with full control over confidentiality, integrity, and availability of the host. No public exploit code has been identified at time of analysis, but the low attack complexity (AC:L) indicates exploitation does not require precise timing or environmental conditions once local access is established.