CVE-2026-62723

The CVSS-EPSS gap for this TAPI use-after-free isn't a scoring artifact — it's a signal that our threat models haven't caught up with how this particular service sits in modern Windows environments. A CVSS 7 UAF yielding SYSTEM-level code execution should sit higher on the exploitation probability curve than an EPSS of 0.00252 suggests, and the gap deserves analysis rather than dismissal. The 'authorized attacker' qualifier is doing work in the vulnerability description that most defenders aren't pressure-testing. It implies the attacker needs local access or compromised credentials to reach TAPI's RPC surface — but an actor who already has that context isn't browsing for new escalation paths. They're executing a known objective. Framing this as 'less severe because it requires authorized access' conflates 'contained' with 'irrelevant,' which is exactly the reasoning that lets Windows service UAFs slide through patching queues. But here's what the scoring models miss: TAPI isn't just another privilege escalation vector. It's telephony infrastructure. SYSTEM access through TAPI doesn't mean 'elevated Windows access' — it potentially means compromising the organization's voice communication layer: call routing, conferencing systems, legacy PBX integrations. That's a different domain of access entirely, one most security tooling doesn't monitor and most threat models don't account for. A UAF in the print spooler and a UAF in TAPI can have identical CVSS scores, but their blast radiuses are categorically different. The low EPSS likely reflects that TAPI sits in a dangerous middle state — deprecated in practice but not formally deprecated in the security maintenance lifecycle. Nobody's actively fuzzing or auditing it. The research community mapped this surface years ago and moved on. That absence of current exploitation proof isn't evidence the attack is impractical; it's evidence the target is forgotten. Forgotten services with SYSTEM privileges and RPC exposure are exactly the attack surface that gets targeted once the 'modern' hardening makes those paths harder. For defenders: prioritize this patch not because EPSS says it's actively exploited, but because TAPI compromise extends into voice infrastructure that other privilege escalations can't reach. The window between 'vulnerability disclosed' and 'vulnerability patched' is where temporal debt accumulates — and for a forgotten subsystem with critical infrastructure implications, that debt compounds faster than the scoring models capture.

Reviewed through automated stages and approved by a human before publication.