What is the CVSS score of EUVD-2026-35725?

EUVD-2026-35725 has a CVSS 3.1 base score of 7.0 (High). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Windows Telephony Service are affected by EUVD-2026-35725?

Microsoft Windows Telephony Service contains a local privilege escalation vulnerability (CVE-2026-42912, CVSS 7.0) that enables authenticated low-privilege users to achieve full system compromise,…. A patch is available.

How to fix or mitigate EUVD-2026-35725?

Within 24 hours: Identify and inventory all Windows systems running Telephony Service; assess system criticality and user access patterns. Within 7 days: Obtain and test the vendor patch in a non-production environment per Microsoft advisory; develop a phased deployment schedule by priority tier. Within 30 days: Complete patch deployment across all affected systems, prioritizing production servers and high-value endpoints.

Windows Telephony Service EUVD-2026-35725

| CVE-2026-42912 HIGH

Race Condition (CWE-362)

2026-06-09 secure@microsoft.com

GHSA-p5rf-w8rc-h46h

Information Disclosure Microsoft Race Condition

7.0

CVSS 3.1 · NVD

Temporal: 6.1

Severity by source

NVD PRIMARY

7.0 HIGH

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CIRCL (temporal)

6.1 MEDIUM

cvss

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 18:37 vuln.today

CVE Published

Jun 09, 2026 - 17:17 nvd

HIGH 7.0

DescriptionNVD

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Telephony Service allows an authorized attacker to elevate privileges locally.

AnalysisAI

Local privilege escalation in Microsoft Windows Telephony Service allows an authenticated low-privileged attacker to elevate to higher privileges by exploiting a race condition in concurrent access to a shared resource. The flaw carries a CVSS 7.0 (High) rating with high attack complexity, and no public exploit identified at time of analysis. Successful exploitation grants full confidentiality, integrity, and availability impact on the affected host.

Technical ContextAI

The Windows Telephony Service (TapiSrv) is a long-standing Windows component that provides the Telephony API (TAPI) for applications that interact with phone-line, modem, and VoIP devices. The root cause is CWE-362 (Concurrent Execution Using Shared Resource with Improper Synchronization - 'Race Condition'), meaning two or more execution flows access a shared object without adequate locking, creating a time-of-check to time-of-use (TOCTOU) window an attacker can win to manipulate state the service later trusts. Because the Telephony Service runs with elevated privileges, winning the race lets a low-privileged caller induce the service to perform actions in its privileged context. No CPE strings were enumerated in the provided data, but the vendor advisory at msrc.microsoft.com (CVE-2026-42912) is the authoritative source for the exact Windows builds covered.

RemediationAI

Apply the patch available from vendor per the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42912; install the corresponding monthly cumulative update for each affected Windows SKU through Windows Update, WSUS, or your patch management tooling (exact KB numbers are listed on the MSRC page and were not enumerated in the input data). Where immediate patching is not possible, a workable compensating control is to stop and disable the Telephony Service (services.msc → Telephony, or 'sc config TapiSrv start= disabled' followed by 'sc stop TapiSrv') on systems that do not use TAPI applications - the trade-off is that any modem, fax, dial-up, or legacy CTI/VoIP software relying on TAPI will break, so validate dependencies on RAS, dial-up VPN, and any call-center clients before disabling. On multi-user systems (RDS, VDI, shared workstations) where exposure is highest, prioritize this update over single-user endpoints.