What is the CVSS score of EUVD-2026-56639?

EUVD-2026-56639 has a CVSS 3.1 base score of 7.0 (High). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Windows Telephony Service are affected by EUVD-2026-56639?

Windows Telephony Service (TAPI) contains a privilege escalation vulnerability affecting all supported Windows desktop and server versions, enabling local users to achieve complete system compromise.. A patch is available.

How to fix or mitigate EUVD-2026-56639?

Within 24 hours, identify and inventory all Windows 10, Windows 11, and Windows Server systems in your environment, prioritizing servers that host critical services or sensitive data. Within 7 days, obtain vendor patches and deploy to test and development environments to validate compatibility with line-of-business applications. Within 30 days, deploy patches to all production systems using a staged rollout, prioritizing systems with high user concurrency or privileged access.

Windows Telephony Service EUVD-2026-56639

| CVE-2026-62725 HIGH

Use After Free (CWE-416)

2026-08-11 secure@microsoft.com

GHSA-r78r-2vvj-j46m

Denial Of Service Use After Free Memory Corruption Microsoft Windows 10 1607 Windows 10 1809 Windows 10 21h2 Windows 10 22h2 Windows 11 23h2 Windows 11 24h2 Windows 11 25h2 Windows 11 26h1 Windows Server 2012 Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows Server 2025

7.0

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

7.0 HIGH

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

Local-only TAPI client access with low privilege and high complexity race condition matches the UAF pattern; full C/I/A reflects SYSTEM-level escalation within the unchanged scope.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 20:24 vuln.today

Patch available

Aug 11, 2026 - 18:19 EUVD

CVE Published

Aug 11, 2026 - 17:18 nvd

HIGH 7.0

DescriptionCVE.org

Use after free in Windows Telephony Service allows an authorized attacker to elevate privileges locally.

AnalysisAI

Local privilege escalation via use-after-free (CWE-416) in the Windows Telephony Service (TAPI) affects every supported Windows desktop and server release, from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. An authorized low-privileged local attacker can trigger improper memory lifecycle management in the privileged tapisrv process, achieving full confidentiality, integrity, and availability impact on the compromised system. No public exploit code has been identified at time of analysis and high attack complexity constrains opportunistic mass exploitation, but vendor-released patches are available and should be prioritized given the ubiquitous deployment footprint.

Technical ContextAI

The Windows Telephony Application Programming Interface (TAPI) service (tapisrv) provides call-management and voice/data communication abstractions consumed by modem software, legacy VoIP clients, and remote-access services. CWE-416 (Use After Free) arises when a heap-allocated object is freed but a dangling pointer persists and is subsequently dereferenced - here within the Telephony Service's privileged process space. Because tapisrv exposes a client-callable RPC/COM interface locally, a low-privileged user can invoke TAPI API sequences that reach the vulnerable code path. The affected build range spans Windows NT kernel versions from 6.2.9200 (Server 2012) through 10.0.28000 (Windows 11 26H1), covering both desktop and server SKUs with and without Server Core installations, as confirmed by EUVD-2026-56639.

RemediationAI

Apply Microsoft's vendor-released patches through Windows Update, WSUS, or Microsoft Update Catalog, targeting the fixed build versions per platform: Server 2012 to 6.2.9200.26279, Server 2012 R2 to 6.3.9600.23337, Server 2016 and Windows 10 1607 to 10.0.14393.9418, Server 2019 and Windows 10 1809 to 10.0.17763.9115, Server 2022 to 10.0.20348.5499, Windows 10 21H2 to 10.0.19044.7663, Windows 10 22H2 to 10.0.19045.7663, Windows 11 23H2 to 10.0.22631.7517, Windows 11 24H2 and Server 2025 to 10.0.26100.33296 (desktop 24H2 to 10.0.26100.9168), Windows 11 25H2 to 10.0.26200.9168, Windows 11 26H1 to 10.0.28000.2704. Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62725. Where immediate patching is not feasible, consider disabling the Windows Telephony Service (tapisrv) via 'services.msc' or Group Policy - note this will break modem-dependent applications, legacy VoIP clients, Dial-Up Networking, and any software relying on the TAPI API, so assess application dependencies before applying this workaround. Additionally, enforce the principle of least privilege to reduce the population of local accounts that could be leveraged as an entry point for this escalation.