CVE-2026-62723: Windows Telephony Service UAF Vulnerability

CVE-2026-62723 Overview

CVE-2026-62723 is a use-after-free vulnerability [CWE-416] in the Windows Telephony Service. An authorized local attacker can exploit the flaw to elevate privileges on an affected host. Microsoft classifies the issue as high severity, and successful exploitation yields high impact to confidentiality, integrity, and availability. The attack requires local access and low privileges, but has high attack complexity, meaning exploitation depends on winning a race or meeting specific memory-state conditions. No public exploit code or in-the-wild activity has been reported at the time of publication.

Critical Impact
A local, authenticated attacker who successfully triggers the use-after-free can execute code in the context of the Windows Telephony Service and gain elevated privileges on the host.

Affected Products

Microsoft Windows (Telephony Service component)
Specific build and version details are published in the Microsoft Security Response Center advisory
Refer to the Microsoft CVE-2026-62723 Update for the authoritative list of affected builds

Discovery Timeline

2026-08-11 - CVE-2026-62723 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-62723

Vulnerability Analysis

The vulnerability is a use-after-free condition [CWE-416] in the Windows Telephony Service (TapiSrv). Use-after-free flaws occur when code continues to reference a memory allocation after it has been released back to the heap. If an attacker can influence the allocator to reuse that memory with attacker-controlled data before the dangling reference is dereferenced, the process can be coerced into using crafted pointers or object layouts.

Because the Telephony Service runs with elevated privileges under svchost.exe, controlled reuse of freed memory can be steered toward arbitrary code execution in a higher privilege context. The attack vector is local, and the attacker must already be authenticated to the system. High attack complexity indicates exploitation likely requires winning a race condition against object allocation or lifetime state.

Root Cause

The root cause is improper object lifetime management within the Telephony Service. A code path frees an object while another path retains a reference to it, then later dereferences that pointer. Without a strong lock or reference-count check between the free and the reuse, the freed slot can be reoccupied by attacker-influenced data.

Attack Vector

An attacker with a valid local account interacts with the Telephony Service through its documented interfaces, such as TAPI remote procedure calls. By sequencing requests to allocate, free, and re-reference internal objects, the attacker triggers dereference of a stale pointer. Successful exploitation yields code execution in the service, resulting in privilege elevation from a standard user to SYSTEM.

No verified proof-of-concept code is publicly available. Consult the Microsoft CVE-2026-62723 Update for technical guidance.

Detection Methods for CVE-2026-62723

Indicators of Compromise

Unexpected crashes or restarts of svchost.exe hosting the Telephony Service (TapiSrv), which may indicate exploitation attempts against the freed object
Creation of new privileged processes spawned as children of the Telephony Service svchost.exe instance
Anomalous local RPC traffic targeting the TAPI interface from non-administrative user sessions

Detection Strategies

Hunt for processes launched by the Telephony Service svchost.exe that are inconsistent with normal telephony operations, particularly command interpreters or LOLBins
Correlate Windows Error Reporting events for TapiSrv faults with subsequent privilege changes on the same host
Alert on non-administrative accounts opening handles to Telephony Service RPC endpoints in rapid succession, a pattern typical of race-condition exploitation

Monitoring Recommendations

Enable Sysmon Event ID 1 (process create) and 10 (process access) to track access to the Telephony Service and any child processes it spawns
Ingest Windows Security and System event logs into a centralized SIEM to correlate service crashes with account activity
Monitor for privilege escalation artifacts such as token elevation events (Event ID 4672) following Telephony Service faults

How to Mitigate CVE-2026-62723

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft CVE-2026-62723 Update as soon as the patch is validated in your environment
Restrict interactive and remote logon rights on affected hosts to reduce the population of accounts able to reach the local attack surface
Inventory systems running the Telephony Service and prioritize patching on multi-user hosts such as Remote Desktop and jump servers

Patch Information

Microsoft has published guidance and updates via the Microsoft Security Response Center. Refer to the Microsoft CVE-2026-62723 Update for the specific KB articles and build numbers that remediate the use-after-free. Deploy through your standard Windows Update, WSUS, or Intune channels.

Workarounds

If patching cannot be applied immediately and the Telephony Service is not required, disable it via sc.exe config TapiSrv start= disabled and stop the running service
Constrain local account creation and enforce least privilege so that untrusted users cannot obtain the local authenticated access required for exploitation
Apply application control policies such as Windows Defender Application Control to block unauthorized binaries from executing on affected hosts

bash

# Configuration example: disable the Telephony Service where it is not required
sc.exe stop TapiSrv
sc.exe config TapiSrv start= disabled

# Verify status
sc.exe query TapiSrv