What is the CVSS score of EUVD-2026-29597?

EUVD-2026-29597 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Windows Telephony Service are affected by EUVD-2026-29597?

Windows Telephony Service (TAPI) privilege escalation vulnerability (CVSS 7.8) affects Windows 10 through 11 and Server 2012-2025, exposing millions of devices to system-level compromise through…. A patch is available.

How to fix or mitigate EUVD-2026-29597?

Within 24 hours, inventory all Windows 10 (build 1607+), Windows 11, and Windows Server 2012-2025 systems to identify patch readiness and determine deployment prioritization; flag any TAPI-dependent applications or systems with direct user logon. Within 7 days, procure and test the vendor-released TAPI patch in a controlled environment on representative systems to validate compatibility with business applications before enterprise rollout. Within 30 days, deploy the patch organization-wide starting with critical infrastructure (domain controllers, identity servers, centralized services) proceeding to standard endpoints; perform post-deployment vulnerability scanning to confirm remediation across the fleet.

Windows Telephony Service EUVD-2026-29597

| CVE-2026-34338 HIGH

Use After Free (CWE-416)

2026-05-12 microsoft

GHSA-wjp8-23w4-8hcj

Denial Of Service Use After Free Memory Corruption Microsoft Windows Server 2012 Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows Server 2025 Windows 10 Version 1607 Windows 10 Version 1809 Windows 10 Version 21H2 Windows 10 Version 22H2 Windows Server 2016 Server Core Installation Windows Server 2019 Server Core Installation Windows 11 Version 22H3 Windows 11 Version 23H2 Windows 11 Version 24H2 Windows 11 Version 25H2 Windows 11 Version 26H1 Windows Server 2022 23H2 Edition Server Core Installation Windows Server 2025 Server Core Installation Windows Server 2012 Server Core Installation Windows Server 2012 R2 Windows Server 2012 R2 Server Core Installation

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

Local authenticated access (AV:L/PR:L); AC:H because a use-after-free race must be won for reliable exploitation; full SYSTEM compromise gives C:H/I:H/A:H.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 21:24 vuln.today

CVE Published

May 12, 2026 - 16:59 nvd

HIGH 7.8

DescriptionCVE.org

Use after free in Windows Telephony Service allows an authorized attacker to elevate privileges locally.

AnalysisAI

Local privilege escalation in the Windows Telephony Service (TAPI) affects a broad range of Windows client and server releases, from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025. An authenticated local attacker can exploit a use-after-free (CWE-416) memory-corruption flaw to gain SYSTEM-level privileges; there is no public exploit identified at time of analysis and EPSS is very low (0.04%), but the CVSS 3.1 base score is 7.8 with total technical impact per CISA SSVC.

Technical ContextAI

The Windows Telephony Service implements the Telephony API (TAPI), a legacy Windows subsystem that mediates access to modems, telephony hardware, VoIP and call-control functions for user applications. The root cause is CWE-416 (Use After Free): the service references a heap object after it has been freed, allowing an attacker who can influence allocation/free timing to reclaim the freed memory with attacker-controlled data and corrupt program state. Because the service runs with elevated (SYSTEM) privileges while accepting requests from lower-privileged local callers, successful memory corruption translates directly into privilege elevation. CPE data confirms the affected component spans Microsoft Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (22H3, 23H2, 24H2, 25H2, 26H1) and Windows Server (2012, 2012 R2, 2016, 2019, 2022, 2022 23H2, 2025).

RemediationAI

Vendor-released patch: apply the Microsoft security update that raises each affected OS to at least the fixed build listed above (e.g., Windows 11 24H2 to 10.0.26100.8457, Server 2022 to 10.0.20348.5139, Windows 10 22H2 to 10.0.19045.7291) via the standard monthly cumulative update; consult https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-34338 for the exact KB per platform. Because exploitation requires local authenticated access to the Telephony Service, a compensating control where immediate patching is not possible is to stop and disable the Telephony service (TapiSrv) - this closes the attack surface but will break TAPI-dependent applications such as dial-up/RAS clients, some fax and modem software, and legacy CTI/VoIP integrations, so validate dependencies first. General EoP hardening (least-privilege accounts, restricting interactive/local logon, EDR monitoring for anomalous SYSTEM token acquisition) reduces the population of attackers who can reach the service. Prioritize patching multi-user and shared hosts (RDS/Citrix, terminal servers) where untrusted low-privileged users can run code locally.