Windows Telephony Service EUVD-2026-56609

Exploitation requires an authenticated local session with at least low-privilege access (confirmed by PR:L in the CVSS vector), meaning the attacker must have prior ability to execute code on the target system - remote exploitation without a pre-existing foothold is not possible. The Windows Telephony Service (TapiSrv) must be running; it is enabled and started by default on Windows desktop and server editions, so no non-default configuration is required. High attack complexity (AC:H) means the race condition demands precise thread-timing and likely repeated attempts before the race window is reliably won, limiting the feasibility of fully automated or single-shot exploitation. Scope is unchanged (S:U), confining the impact to the local system and preventing lateral movement directly from this vulnerability alone. Exploitation is limited by: requirement for a local foothold before exploitation can begin; the non-deterministic timing requirement that raises operational complexity; and the absence (at time of analysis) of public exploit tooling.

The CVSS 7.0 score (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects an important but operationally bounded threat: local access and a high-complexity timing requirement are genuine barriers that prevent mass remote exploitation. The high attack complexity (AC:H) means an attacker must win a race window - likely requiring repeated attempts or a helper thread - which raises the bar compared to deterministic local privilege escalation bugs. EPSS data is absent from the provided intelligence, so the statistical exploitation probability cannot be independently quantified; probability is inferred solely from CVSS complexity and the absence of a known public exploit. The vulnerability is not listed in CISA KEV, and no proof-of-concept code has surfaced in the available sources - both favorable signals. However, the patch surface is enormous: nineteen distinct version ranges across Windows 10, Windows 11, and six Windows Server generations are affected, meaning even a mid-sized municipal IT team in rybnik should treat this as a priority patch cycle item given how many Windows asset types fall within scope. The combination of low initial privilege requirement and full post-exploitation system compromise (C:H/I:H/A:H) makes this an effective second-stage privilege escalation tool for attackers who have already obtained an initial foothold via phishing, credential theft, or another vulnerability.

An attacker who has obtained a low-privilege local session - through credential theft, a phishing payload, or exploitation of a separate initial-access vulnerability - repeatedly invokes concurrent TAPI operations targeting the Telephony Service's shared internal state, attempting to win a timing race between a privilege check and its associated action. After a statistically sufficient number of attempts at the race window, the attacker successfully redirects a privileged operation to attacker-controlled code or memory, resulting in SYSTEM-level code execution on the local machine. No public proof-of-concept exploit has been identified at time of analysis, though the CWE-362 class is well-understood and tools for racing Windows service handles exist in offensive toolkits.