Windows Telephony Server EUVD-2026-99450

Exploitation requires the attacker to already have local, authenticated code-execution on the target as a low-privileged user (PR:L) - this is a post-access escalation, not a remote entry point. The attacker must be able to interact with the Windows Telephony Service (TAPI) to reach the vulnerable use-after-free code path. No user interaction is needed (UI:N) and attack complexity is low (AC:L), but the local-only vector (AV:L) and the prerequisite foothold are the primary limiting factors; reliable exploitation of a UAF also generally depends on heap state, so weaponization effort, while modest, is non-trivial. The affected component is present by default across all listed Windows 10/11 and Windows Server 2012-2025 builds below the patched versions.

This is a genuine but second-tier priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) is internally consistent: local attack vector, low complexity, and low privileges already required (an authenticated/logged-on user), yielding total confidentiality, integrity, and availability impact on the host via a use-after-free (CWE-416). CISA's SSVC framework aligns with a non-urgent posture - Exploitation: none, Automatable: no, Technical Impact: total - meaning high per-host impact but no evidence of exploitation and no mass-exploitation potential (consistent with a local-only EoP that cannot be worm-driven over the network). No EPSS score was provided in the input, no CISA KEV listing is present, and no POC is referenced, so exploitation status is 'no public exploit identified at time of analysis.' There is no signal conflict here: every source (CVSS local vector, SSVC 'Exploitation: none', absence of KEV) points the same direction - a real, patch-worthy local privilege-escalation bug that is not under active exploitation. The main caveat is that Windows Telephony Server EoP flaws are historically popular as post-compromise escalation primitives and Microsoft has shipped many near-identical CVEs, so it should be patched on the normal Patch-Tuesday cadence rather than treated as an emergency.

An attacker who already has a low-privileged foothold on a Windows host (e.g., via phishing, a stolen standard-user credential, or an unprivileged service) runs a crafted program that interacts with the Telephony (TAPI) service to trigger the use-after-free. By grooming the heap and reclaiming the freed object, they corrupt memory to execute code in the service's privileged context and elevate to SYSTEM. No public exploit code was identified at the time of analysis, but local, low-complexity UAF primitives of this type are routinely weaponized once details circulate.