Use after free in Windows Telephony Service can be exploited by an authorized local attacker to gain higher privileges (potentially system level). The flaw arises when the service frees memory prematurely and then continues to access or modify that memory, allowing the attacker to influence code execution or data. This type of vulnerability could allow an attacker to elevate from a standard user to an administrator, gaining full control over the affected machine.

Microsoft Windows 10 (Versions 1607, 1809, 21H2, 22H2), Windows 11 (Versions 22H3, 23H2, 24H2, 25H2, 26H1), Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025, and the 23H2 edition. The vulnerability is present only in the listed releases, not in earlier or later builds.

The CVSS score of 7.8 indicates high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local, requiring an authorized user to exploit the use‑after‑free via the Telephony Service. No public exploits have been reported, and the window for exploitation is limited to machines that run the affected versions and have the Telephony Service enabled.