CVE-2026-62726: Windows Telephony Service Privilege Escalation

CVE-2026-62726 Overview

CVE-2026-62726 is a use-after-free vulnerability [CWE-416] in the Windows Telephony Service. The flaw allows an authenticated local attacker to elevate privileges on an affected Windows host. Microsoft published the advisory on 2026-08-11 and last updated it on 2026-08-12.

Exploitation requires local access and low privileges, but no user interaction. Successful exploitation compromises confidentiality, integrity, and availability of the target system. The EPSS probability sits at 0.252% with a percentile of 16.702, indicating limited near-term exploitation likelihood at publication.

Critical Impact
An authorized local attacker who wins a race window in the Windows Telephony Service can execute code with elevated privileges and take full control of the affected host.

Affected Products

Windows Telephony Service (Microsoft Windows)
Refer to the Microsoft Security Update CVE-2026-62726 advisory for the authoritative list of affected builds
Systems where the Telephony Service (TapiSrv) is enabled

Discovery Timeline

2026-08-11 - CVE-2026-62726 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-62726

Vulnerability Analysis

The vulnerability resides in the Windows Telephony Service, a component that manages Telephony API (TAPI) requests on Windows systems. The service mishandles the lifecycle of an internal object, freeing memory while another code path still holds a reference to it. When the dangling reference is later dereferenced, the attacker-controlled contents of the reclaimed allocation determine execution flow.

Because the Telephony Service runs with SYSTEM-level privileges through a shared service host, a successful exploit yields privilege escalation from a standard user account to SYSTEM. The vulnerability is classified under [CWE-416] Use After Free.

The attack complexity is high, indicating the attacker must win a race condition or satisfy specific state conditions to trigger the freed-object reuse. No user interaction is required, and the scope remains unchanged.

Root Cause

The root cause is improper object lifetime management inside the Telephony Service. A code path releases an object without invalidating outstanding references, leaving a stale pointer accessible to a concurrent operation. Attackers who reallocate the freed region with controlled data can hijack a virtual function call or callback dispatch.

Attack Vector

An authenticated local user issues crafted TAPI requests to the Telephony Service through documented client interfaces. By racing request handling and object teardown, the attacker triggers reuse of freed memory. Reliable exploitation typically requires heap grooming and repeated attempts to satisfy the timing window.

No verified public proof-of-concept is available. See the Microsoft Security Update CVE-2026-62726 advisory for technical details.

Detection Methods for CVE-2026-62726

Indicators of Compromise

Unexpected crashes or restarts of the TapiSrv service or the hosting svchost.exe process
Creation of new SYSTEM-level processes spawned from user sessions shortly after Telephony Service activity
Anomalous local RPC traffic from non-administrative users to the Telephony Service endpoint
Windows Error Reporting entries referencing access violations inside tapisrv.dll or related telephony modules

Detection Strategies

Monitor process ancestry for SYSTEM processes descending from svchost.exe hosting the Telephony Service when initiated by standard user contexts
Alert on repeated TapiSrv service crashes on the same host within a short interval, which indicates race-condition exploitation attempts
Correlate local RPC calls to the Telephony Service with subsequent privilege token changes on the endpoint

Monitoring Recommendations

Enable Windows Sysmon Event IDs 1 (process create), 10 (process access), and 11 (file create) to capture Telephony Service exploitation artifacts
Ingest Windows Service Control Manager events (Event ID 7031, 7034) tracking Telephony Service failures
Baseline TAPI usage per host and flag deviations from standard users who normally do not invoke the service

How to Mitigate CVE-2026-62726

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update CVE-2026-62726 advisory to all affected Windows systems
Prioritize patching on multi-user hosts, jump servers, and Remote Desktop Session Hosts where local accounts are more numerous
Audit local account privileges and remove unnecessary interactive logon rights

Patch Information

Microsoft has issued a security update addressing the use-after-free defect in the Windows Telephony Service. Deploy the update through Windows Update, WSUS, or your enterprise patch management tooling. Refer to the Microsoft Security Update CVE-2026-62726 advisory for the specific KB article and affected builds.

Workarounds

If the Telephony Service is not required for business operations, disable it by setting the TapiSrv service startup type to Disabled
Restrict local logon rights so untrusted users cannot execute code on hosts where the service must remain enabled
Apply application control policies to prevent unauthorized binaries from invoking TAPI client libraries

bash

# Configuration example: disable the Windows Telephony Service where unused
sc.exe config TapiSrv start= disabled
sc.exe stop TapiSrv