Windows Telephony Server EUVD-2026-99521

Requires the attacker to already have authenticated, low-privileged local access to the target host (CVSS PR:L, AV:L) - this is a privilege-escalation primitive, not a remote entry point. The high attack complexity (AC:H) reflects a use-after-free race condition that must be reliably won, making exploitation timing-dependent and less deterministic. No user interaction is required (UI:N). The Windows Telephony Server service must be present and reachable by the attacker's process; it ships enabled across supported Windows editions, so no non-default configuration is needed. Primary limiting factors: the need for a pre-existing local account and the difficulty of winning the race reliably, which together constrain this to post-compromise escalation scenarios, especially relevant on multi-user and session-host systems.

This is a moderate-priority, not emergency, patch. The CVSS 3.1 base score is 7.0 (High) with vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning exploitation requires local access, already-held low privileges, AND a high-complexity precondition (AC:H) - consistent with a use-after-free (CWE-416) race condition that an attacker must win reliably. The SSVC decision framework reinforces this downgrade: Exploitation is rated 'none' (no observed or public exploitation), Automatable is 'no' (AC:H race conditions cannot be reliably mass-automated), while Technical Impact is 'total' (full SYSTEM-level compromise if successful). No CISA KEV listing and no POC are present in the provided data, and there is no EPSS score supplied to gauge exploitation probability - its absence is a data gap, not a signal. The signals are internally consistent: high technical impact but constrained, non-automatable, local-only exploitation with no evidence of in-the-wild use. This is a classic 'high CVSS, contained real-world risk' local privilege-escalation that belongs in the standard Patch Tuesday cycle rather than emergency out-of-band remediation, prioritized on multi-user hosts, RDP/session hosts, and shared workstations where low-privileged attackers are present.

A low-privileged but authenticated local user (e.g., on a shared terminal server or a workstation where the attacker already has a foothold) executes code that interacts with the Windows Telephony Server service to trigger a use-after-free condition. By winning a timing-dependent race to reclaim the freed object with attacker-controlled data, they corrupt memory to execute code in the service's security context and elevate to SYSTEM. No public exploit identified at time of analysis, and the AC:H rating means the race must be won reliably, reducing real-world ease of exploitation.