The Windows Telephony Service contains a use‑after‑free flaw that permits an attacker who already has local access to run arbitrary code at the level of the service. The flaw arises when the service releases memory that is subsequently dereferenced, enabling the attacker to manipulate the service’s execution flow. If exploited, the attacker can gain elevated privileges, effectively allowing them to install software, steal data, or perform other privileged actions on the host.

Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Microsoft Windows 11 versions 23H2, 24H2, 25H2, 22H3, and 26H1; Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025, and the 23H2 Edition; all listed processor architectures as noted in the CPEs.

The CVSS score of 7.8 classifies the vulnerability as medium‑to‑high severity. The attack requires local privileged access, which means an attacker must first log in or gain a local foothold. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating no known widespread exploitation yet. Nonetheless, local privilege escalation can lead to full system compromise, so organizations should treat it as a high‑priority issue.