A use‑after‑free flaw in the Windows Telephony Server allows an attacker who already has local access to elevate their privileges, potentially gaining full control over the affected system. The vulnerability is a memory corruption weakness classified as CWE‑416, which can lead to the attacker running arbitrary code with elevated rights, compromising confidentiality, integrity, and availability of the device.

Microsoft Windows 10 versions 1607, 1809, 21H2, 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1 (including the arm64‑based 26H2 build); Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, both standard and Server Core installations.

The CVSS score of 7.0 indicates moderate severity, while the EPSS score is not available, making it difficult to gauge current exploitation probability. The vulnerability requires local, authorized access to the system and is listed as not in the CISA KEV catalog, so while exploitation is plausible, it is not known to be actively used in the wild. The lack of listed exploits suggests that the risk is moderate, but organizations with critical telephony services should treat it as a priority when updating.