EUVD-2026-29658
GHSA-x54x-93qg-234m
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local authenticated low-privilege user triggers the flaw with no interaction (AV:L/PR:L/UI:N); a use-after-free EoP to SYSTEM yields full C/I/A impact with unchanged scope.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
Use after free in Windows Telephony Service allows an authorized attacker to elevate privileges locally.
AnalysisAI
Local privilege escalation in the Microsoft Windows Telephony Service (TAPI) lets an already-authenticated low-privileged user corrupt kernel/service memory via a use-after-free and gain elevated (typically SYSTEM-level) privileges across nearly all supported Windows client and server releases. Microsoft has released patches, and the flaw carries a total technical-impact rating (SSVC), though EPSS is very low (0.04%) and there is no public exploit identified at time of analysis. It is not on CISA KEV, indicating no confirmed active exploitation.
Technical ContextAI
The Windows Telephony Service implements the Telephony API (TAPI), a long-standing Windows subsystem that brokers telephony/communications functions for local applications through RPC-accessible interfaces. The root cause is CWE-416 (Use After Free): the service continues to reference a memory object after it has been freed, allowing an attacker who controls subsequent allocations to manipulate the dangling pointer and achieve controlled memory corruption. The CPE data confirms the affected surface is the Microsoft Windows operating system itself across Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (22H3/23H2/24H2/25H2/26H1), and Windows Server 2012 through 2025, meaning the vulnerable TAPI component ships as a core OS service rather than an optional add-on.
RemediationAI
Apply the Microsoft security update for CVE-2026-40382 via the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40382; Vendor-released patch corresponds to the fixed build for each edition (for example, upgrade Windows 11 24H2 to 10.0.26100.8457 or later, Windows 10 22H2 to 10.0.19045.7291 or later, and Windows Server 2025 to 10.0.26100.32860 or later) as listed in the EUVD data. Deploy through standard Windows Update / WSUS / your patch-management tooling and prioritize systems where untrusted or low-privileged users have interactive access. As an interim compensating control where patching must be delayed, the Windows Telephony (TapiSrv) service can be disabled or set to manual/demand-start on systems that do not rely on TAPI-based telephony/modem/fax functionality, which removes the attack surface but will break any applications or dialers depending on telephony APIs - validate application dependencies before disabling. Additional references: vendor advisory mirror at https://nvd.nist.gov/vuln/detail/CVE-2026-40382 and https://vuldb.com/vuln/363189.
More in Windows Server 2012
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Remote code execution in Microsoft Office 2007-2016 and Windows Vista through 10 allows attackers to execute arbitrary c
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
The Win32k kernel-mode driver in Windows Vista through Windows Server 2016 allows local privilege escalation, exploited
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Active Directory Domain Services Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.5), this vulnerabilit
Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today