EUVD-2026-29709
GHSA-657m-fh2j-4m4r
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Local authenticated user (AV:L/PR:L) must win a use-after-free race (AC:H); successful escalation yields full control of the host, so C/I/A all High, scope unchanged.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
Use after free in Windows Telephony Service allows an authorized attacker to elevate privileges locally.
AnalysisAI
Local privilege escalation in the Microsoft Windows Telephony Service (TAPI) lets an already-authenticated, low-privileged user corrupt kernel/service memory via a use-after-free and gain elevated privileges across virtually all supported Windows client and server builds. Microsoft has released a patch, and there is no public exploit identified at time of analysis; EPSS is negligible (0.04%) and CISA's SSVC rates exploitation as none, indicating this is a defense-in-depth fix rather than an emergency. The flaw is high-value as a post-compromise escalation primitive but requires local code execution and winning a race condition to trigger.
Technical ContextAI
The Windows Telephony Service implements the Telephony API (TAPI), a long-standing component that brokers telephony/modem and call-control operations for user applications through RPC-style calls into a privileged service. The root cause is CWE-416 (Use After Free): an object is freed while a reference to it remains in use, so a subsequent operation dereferences dangling memory. An attacker who can control heap allocation timing can reclaim the freed object with attacker-shaped data and hijack execution flow or corrupt privileged state. The CPE set spans the microsoft:windows_10 and windows_11 families plus windows_server_2012, and the EUVD build ranges confirm the affected component ships in Windows 10 (1607 through 22H2), Windows 11 (22H3 through 26H1), and Windows Server 2012 through 2025, reflecting how deeply TAPI is embedded in the OS.
RemediationAI
Vendor-released patch: apply the Microsoft security update that raises each SKU to at least its fixed build (e.g. Windows 11 24H2 to 10.0.26100.8457, Windows 10 22H2 to 10.0.19045.7291, Server 2022 to 10.0.20348.5139, Server 2012 to 6.2.9200.26079) via Windows Update or WSUS, per the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42825. Patching is the correct fix since this is an in-OS component. Where immediate patching is not possible, a compensating control is to reduce reliance on the Telephony service: on servers and endpoints that do not use modem/TAPI functionality, set the 'Telephony' (TapiSrv) service to Disabled or Manual to shrink the attack surface - trade-off is that any legitimate dial-up, RAS, or telephony-dependent application will break, so validate before disabling. Because exploitation requires an authenticated local user, also enforce least privilege, restrict interactive/local logon rights, and monitor for unexpected TapiSrv crashes (possible UAF/DoS attempts). Reference: EUVD https://nvd.nist.gov/vuln/detail/CVE-2026-42825.
More in Windows 10 Version 1607
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to run arbitr
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem
Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating
Remote code execution in Microsoft Windows Remote Desktop (RDP) allows an unauthorized network attacker to run arbitrary
Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today