Windows Telephony Service EUVD-2026-56647

Exploitation requires an authorized attacker to already hold a low-privileged account with the ability to execute code locally on the target system (PR:L, AV:L per CVSS vector). The attacker must be able to trigger concurrent execution paths within the Windows Telephony Service, implying the Telephony Service (TapiSrv) must be running - it is enabled by default on most Windows installations. High attack complexity (AC:H) reflects that successfully winning the race condition requires precise thread timing, which limits reliability and opportunistic automation. Exploitation does not require any user interaction (UI:N). Remote unauthenticated exploitation is not possible - physical or network-level access to an authenticated local session is the minimum prerequisite. There is no indication that a non-default configuration is required beyond the service being active.

The CVSS 7.0 score (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects a locally-constrained, complex-to-exploit but high-impact vulnerability. The high attack complexity (AC:H) is the primary risk moderator - race conditions require an attacker to reliably control thread scheduling or resource timing, which reduces opportunistic exploitability significantly compared to straightforward memory corruption. No EPSS data was provided, and the vulnerability is absent from CISA KEV, suggesting no confirmed mass exploitation at time of analysis. No public proof-of-concept has been identified. That said, even a mid-sized municipal IT team in rybnik should treat this as a patching priority given that the blast radius spans virtually every supported and end-of-extended-support Windows release - meaning unpatched exposure is extremely widespread. The full C:H/I:H/A:H triad and absence of user interaction (UI:N) mean successful exploitation yields complete local system compromise. The primary limiting factor is the requirement for an existing low-privileged session on the target machine.

An attacker who has already obtained a low-privileged local session on a Windows system - via phishing, credential theft, or exploitation of another vulnerability - crafts concurrent requests targeting the Windows Telephony Service to induce a race condition in its shared resource handling. By precisely timing thread execution to win the synchronization window between a privilege check and the associated privileged operation, the attacker escalates to SYSTEM or higher-privileged context. No public proof-of-concept is known, but the local access prerequisite and race condition mechanics mean exploitation is feasible for a skilled attacker with time to tune the timing exploit on a target build.