Windows Telephony Service EUVD-2026-56646

Exploitation requires a locally authenticated Windows session with at minimum a standard low-privilege user account (PR:L per CVSS vector). The vulnerable component is Windows Telephony Service (tapisrv), which is present and enabled by default on most Windows client and server installations. No special non-default configuration, elevated permissions beyond a standard user account, or user interaction are required. Exploitation is strictly local (AV:L) - remote unauthenticated attack is not possible. The primary limiting factor is the requirement for local code execution: an attacker must either be physically present, have remote desktop / terminal access, or have already achieved malware execution in a user context. No special TAPI configuration or telephony hardware is required to invoke the vulnerable code path.

The CVSS 7.8 High score is well-calibrated for a local privilege escalation primitive: high C/I/A impact is achievable from a low-privilege local session with low attack complexity. As an LPE, this vulnerability's real-world danger is as a reliable second-stage tool in multi-phase intrusion chains - after initial access via phishing, RCE, or credential theft, an attacker chains this to gain full SYSTEM control. No EPSS data was provided, so probabilistic exploitation likelihood cannot be quantified; exploitation status is not confirmed by KEV or public POC. The breadth of 19 affected Windows SKUs - spanning Server 2012 through Server 2025 and Windows 11 25H2 - creates a wide remediation surface particularly challenging for enterprise environments maintaining legacy Windows Server infrastructure. The AC:L metric signals that exploitation, once a working technique is developed, would be reliable and consistent without needing special conditions.

A standard Windows domain user or malware process running in a low-privilege user context crafts a malformed TAPI API call that triggers the heap-based buffer overflow in tapisrv. The overflow corrupts a heap data structure - such as a function pointer or heap freelist entry - redirecting execution into attacker-controlled shellcode running as SYSTEM. No public proof-of-concept has been identified at time of analysis, but the low attack complexity rating (AC:L) indicates that a working exploit, once developed, would be reliable across the broad range of affected Windows versions.