CVE-2026-62732

Think of the Telephony Service like a system “driver” for phone/telephony features. This flaw is a programming mistake that can be abused by someone who already has low-level access on your computer. If they can reach that service, they can use the bug to jump from low permissions to full control—like taking the keys to the building.

This matters if you run Windows 10, Windows 11, or Windows Server on which the Telephony Service is installed. It’s most relevant when an attacker already has a foothold that’s strong enough to run low-privilege code locally (because no user interaction is needed and the issue is local). The risk is mainly “if the Telephony Service is reachable on a machine and there’s already low-level local access.”

This is a RED issue because exploitation has been reported and the Telephony Service can be leveraged for privilege escalation to full system control. While it requires local access, attackers who gain initial access can use this to quickly escalate inside the organization. Patch immediately for any affected machines where the Telephony Service is installed.

1. Confirm exposure on each host

   • Determine whether the Windows Telephony Service is installed/enabled on the machine (focus on environments that use telephony/phone-related features; otherwise plan to disable/remove the service if not required).
   • Record your exact OS version and build.

2. Check whether the OS is already fixed

   • Compare your build number against the fixed versions below (use the fixed version that matches your specific branch/build):
     • Windows 10: 10.0.14393.9418, 10.0.17763.9121, 10.0.19044.7663, 10.0.19045.7663
     • Windows 11: 10.0.22631.7517, 10.0.26100.9168, 10.0.26200.9168, 10.0.28000.2704
     • Windows Server 2012: 6.2.9200.26280
     • Windows Server 2012 R2: 6.3.9600.23338
     • Windows Server 2016: 10.0.14393.9418
     • Windows Server 2019: 10.0.17763.9121

3. Apply the patch

   • Install the Microsoft security update for CVE-2026-62732 using the MSRC update guide.
   • After installation, verify the machine’s build now matches one of the fixed versions listed above.

4. Temporary mitigation if patching is delayed

   • Disable or remove the Telephony Service on systems that do not require it.
   • Reduce the chance of local low-privilege code execution by tightening local access controls (for example, limit who can log onto the machine and what they can run).

5. What to monitor

   • Look for signs of local compromise and privilege escalation attempts around the time of exposure/patching.
   • Verify that the update applied successfully and did not fail/roll back on any endpoints.

CVE-2026-62732 is a Windows local elevation of privilege vulnerability in the Windows Telephony Service, rooted in a memory safety issue consistent with CWE-122. The mechanism is a local trigger of a memory flaw that allows a low-privileged attacker to gain full control of the system, with no user interaction required. Findings indicate exploitation reported as YES (KEV was not listed in CISA KEV), and patch availability exists with fixed builds across Windows 10, Windows 11, and several Windows Server releases. The issue is best treated as high priority for any machine where the Telephony Service is installed, because an attacker with local low-level access can use it to escalate privileges quickly. No public exploit code was found in the provided findings.