A use‑after‑free flaw in the Windows Telephony Server exposes an attacker with local authorization to execute code with elevated privileges. The vulnerability permits the attacker to trigger the service to use memory that has already been freed, enabling arbitrary code execution or privilege escalation on the affected system.

The flaw affects Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2, as well as Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1. Server editions impacted include Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, both full installations and Server Core.

The CVSS score is 7.8, indicating a high severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack requires a local attacker with the ability to gain authorized access. Because the flaw is a classic use‑after‑free (CWE‑416), exploitation would occur when the compromised process interacts with freed memory, a scenario that is not remotely triggerable. The overall risk is high for any environment where an attacker can achieve local administrative privileges or where the Telephony Server service is exposed to untrusted users.