Skip to main content

Severity by source

NVD PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.8 HIGH

Local authenticated low-privilege user triggers the flaw with no interaction (AV:L/PR:L/UI:N); a use-after-free EoP to SYSTEM yields full C/I/A impact with unchanged scope.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
Analysis Generated
Jul 23, 2026 - 21:18 vuln.today
CVE Published
May 12, 2026 - 16:59 nvd
HIGH 7.8

DescriptionCVE.org

Use after free in Windows Telephony Service allows an authorized attacker to elevate privileges locally.

AnalysisAI

Local privilege escalation in the Microsoft Windows Telephony Service (TAPI) lets an already-authenticated low-privileged user corrupt kernel/service memory via a use-after-free and gain elevated (typically SYSTEM-level) privileges across nearly all supported Windows client and server releases. Microsoft has released patches, and the flaw carries a total technical-impact rating (SSVC), though EPSS is very low (0.04%) and there is no public exploit identified at time of analysis. It is not on CISA KEV, indicating no confirmed active exploitation.

Technical ContextAI

The Windows Telephony Service implements the Telephony API (TAPI), a long-standing Windows subsystem that brokers telephony/communications functions for local applications through RPC-accessible interfaces. The root cause is CWE-416 (Use After Free): the service continues to reference a memory object after it has been freed, allowing an attacker who controls subsequent allocations to manipulate the dangling pointer and achieve controlled memory corruption. The CPE data confirms the affected surface is the Microsoft Windows operating system itself across Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (22H3/23H2/24H2/25H2/26H1), and Windows Server 2012 through 2025, meaning the vulnerable TAPI component ships as a core OS service rather than an optional add-on.

RemediationAI

Apply the Microsoft security update for CVE-2026-40382 via the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40382; Vendor-released patch corresponds to the fixed build for each edition (for example, upgrade Windows 11 24H2 to 10.0.26100.8457 or later, Windows 10 22H2 to 10.0.19045.7291 or later, and Windows Server 2025 to 10.0.26100.32860 or later) as listed in the EUVD data. Deploy through standard Windows Update / WSUS / your patch-management tooling and prioritize systems where untrusted or low-privileged users have interactive access. As an interim compensating control where patching must be delayed, the Windows Telephony (TapiSrv) service can be disabled or set to manual/demand-start on systems that do not rely on TAPI-based telephony/modem/fax functionality, which removes the attack surface but will break any applications or dialers depending on telephony APIs - validate application dependencies before disabling. Additional references: vendor advisory mirror at https://nvd.nist.gov/vuln/detail/CVE-2026-40382 and https://vuldb.com/vuln/363189.

CVE-2026-33824 CRITICAL POC
9.8 Apr 14

Remote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen

CVE-2026-56155 HIGH POC
7.8 Jul 14

Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p

CVE-2026-32202 MEDIUM POC
4.3 Apr 14

Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n

CVE-2026-49798 CRITICAL POC
9.3 Jul 14

Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve

CVE-2026-54128 HIGH POC
8.4 Jul 14

Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff

CVE-2026-50518 CRITICAL
9.8 Jul 14

Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to run arbitr

CVE-2026-50655 HIGH POC
7.8 Jul 14

Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug

CVE-2026-54992 HIGH POC
7.8 Jul 14

Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component

CVE-2026-50489 HIGH POC
7.8 Jul 14

Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem

CVE-2026-50667 HIGH POC
7.0 Jul 14

Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c

CVE-2026-57092 CRITICAL
9.9 Jul 14

Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating

CVE-2026-56190 CRITICAL
9.8 Jul 14

Remote code execution in Microsoft Windows Remote Desktop (RDP) allows an unauthorized network attacker to run arbitrary

Share

CVE-2026-40382 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy