CVE-2026-62701

The mismatch between this CVE's CVSS 7.8 rating and its EPSS score of 0.00318 tells us something important: the EPSS is a temporal signal, not a probability statement. The patch dropped recently, and exploitation requires specific conditions that the EPSS models as unlikely in the immediate window. That doesn't make this vulnerability unimportant — it makes it worth understanding before you file it away as 'patch and move on.' The Telephony Service occupies an uncomfortable middle ground in Windows — not core enough for constant security review, not legacy enough for removal, not modern enough for memory-safe rewrites. This is where UAFs accumulate. The component sits at the intersection of COM/DCOM interfaces with complex object lifetime semantics, hardware abstraction layers, concurrent call state machines, and cross-process IPC. When developers touch this code — adding features, refactoring for new Windows versions, adapting for modern call control APIs — they hit a class of bug that static analysis tools still struggle to model reliably. The cognitive load required to track pointer invalidation across these interfaces is substantial. If this UAF emerged from recent changes, that's the pattern: active modification under constraints, not deferred maintenance. What matters now is the 'authorized attacker' scope. If authorized means any local user on a terminal server farm — common in healthcare and call center environments — then this is a multi-tenant risk with a completely different blast radius than a single-user workstation. The Telephony Service speaks to kernel components and frequently touches third-party call control software with plugin architectures. A UAF with a 'clean' exploitation path doesn't just give you local privilege escalation; it gives you a potential pivot into whatever else is listening on those interfaces. Watch the CVE clustering. When a UAF surfaces in a legacy Windows service like Telephony, it's rarely the last of its kind in that component. The COM lifetime patterns enabling this bug have existed since 2019-2020 — the same structural defects are likely still present in related code paths. If Microsoft is patching Telephony Service now, the next 90 days will tell us whether this was isolated or the first in a lineage. The CVSS 7.8 is telling you the attack surface is real and the exploitation path is clean enough to matter. That's an invitation to look harder at this component, not just at this vulnerability. Your action items: confirm whether Telephony Service runs in multi-tenant or terminal server environments in your fleet, prioritize this patch higher in those contexts, and monitor Microsoft's patch catalog for follow-on Telephony Service CVEs over the next quarter.

Reviewed through automated stages and approved by a human before publication.