Windows Telephony Service EUVD-2026-56361

Exploitation requires an authorized attacker with at least low-privileged local code execution on the target Windows system (PR:L per CVSS vector). The attacker must be able to execute threads concurrently on the host to create the race condition, meaning remote-only access without a local execution primitive is insufficient (AV:L). High attack complexity (AC:H) means the race window must be timed precisely, and exploitation success is not guaranteed on each attempt - reliability typically requires repeated attempts or specific scheduling conditions. No user interaction is required once local code execution is established. Exploitation is limited to systems where the Windows Telephony Service (TapiSrv) is running, which is the default configuration on most Windows desktop and server installations. Exploitation does not require any special application or feature to be enabled beyond the default presence of the Telephony Service.

The CVSS 3.1 base score of 7.0 (High) reflects full CIA triad impact but is substantially tempered by AV:L and AC:H, meaning opportunistic or automated exploitation at scale is unlikely - the attacker must already hold a foothold on the target system and successfully win a timing-sensitive race. No EPSS probability is present in the provided data, and this CVE does not appear in the CISA KEV catalog, confirming no active exploitation has been publicly confirmed at time of analysis. The Information Disclosure tag alongside the privilege escalation classification suggests confidentiality exposure may be a secondary effect of the shared-resource access. Despite the high attack complexity, the breadth of affected platforms - nineteen distinct Windows product lines including Server 2012 through Server 2025 and Windows 10 through 11 - means even a mid-sized municipal IT team in gniezno should treat this as an urgent patching priority, because successful local privilege escalation to SYSTEM on any domain-joined endpoint is a critical post-compromise step enabling credential harvesting and lateral movement. The absence of a public proof-of-concept and the race condition complexity lower the realistic near-term threat, but the ubiquity of the affected OS and the value of the privilege escalation primitive make patching the correct posture over attempting compensating controls.

An attacker who has already gained a foothold as a standard low-privileged user on a vulnerable Windows system - through phishing, credential theft, or initial access exploit - triggers multiple concurrent operations against Windows Telephony Service, racing to manipulate a shared resource in the narrow unsynchronized window between a permission check and its enforcement. If the race is won, the attacker's thread gains write access to a privileged object or memory region, escalating to SYSTEM privileges and enabling full host compromise. No public proof-of-concept is known at time of analysis, and the AC:H rating reflects that reliable exploitation requires careful thread-timing or specific scheduling conditions.