An author or a user with local access to the system can trigger a use‑after‑free condition in the Windows Telephony Service, which in turn allows the attacker to gain elevated privileges on the same machine. This vulnerability is identified as CWE‑416 and does not provide any network or remote capabilities – the exploitation requires local presence and an existing user session.

Microsoft Windows 10 versions from 1607 through 22H2, Windows 11 versions from 23H2 through 26H1, and all Windows Server editions from 2012 to 2025, including core installations and the 23H2 Server Core edition. All 32‑bit, 64‑bit, and ARM64 builds listed under these releases are affected.

The CVSS score of 7.0 indicates a high severity local privilege escalation. No EPSS score is available, but the vulnerability is not listed in the CISA KEV catalog, suggesting no documented exploit in the wild. The most likely attack vector is local: an attacker who has user or administrative privileges on the target machine can manipulate the Telephony Service to trigger the use‑after‑free and elevate their privileges further. No external triggers or special conditions beyond local execution are described in the official data.