This vulnerability (CVE-2026-62727) involves a race condition (CWE-362) in the Windows Telephony Service component of Microsoft Windows 10 Version 1607 and other specified versions. The flaw arises from improper synchronization during concurrent execution using shared resources, which can be exploited by an authorized local attacker to elevate privileges. The CVSS v3.1 base score is 7.0 (high), with attack vector local, high attack complexity, low privileges required, no user interaction, and impacts confidentiality, integrity, and availability. Microsoft has published an official fix for this vulnerability.

An authorized local attacker can exploit this race condition to elevate their privileges on the affected Windows 10 systems. This could lead to full system compromise, including unauthorized access to sensitive information and the ability to execute arbitrary code with elevated rights.

An official fix is available from Microsoft. Users and administrators should apply the security updates provided by Microsoft for the affected Windows 10 versions as detailed in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62727. No additional mitigation actions are indicated by the vendor advisory.