CVE-2024-43635 Overview
CVE-2024-43635 is a remote code execution vulnerability in the Windows Telephony Service. The flaw is tracked under CWE-190 (Integer Overflow or Wraparound) and affects a broad range of Microsoft Windows client and server releases. Microsoft addressed the issue in the November 2024 Patch Tuesday cycle.
An attacker can exploit the vulnerability over the network, but exploitation requires user interaction. Successful exploitation results in code execution in the context of the targeted service, leading to a full compromise of confidentiality, integrity, and availability.
Critical Impact
Network-reachable code execution in the Windows Telephony Service grants attackers the ability to run arbitrary code on unpatched Windows clients and servers when a user is induced to interact with attacker-controlled content.
Affected Products
- Microsoft Windows 10 (1507, 1607, 1809, 21H2, 22H2) across x86, x64, and ARM64
- Microsoft Windows 11 (22H2, 23H2, 24H2) across x64 and ARM64
- Microsoft Windows Server 2008 SP2, 2008 R2 SP1, 2012, 2012 R2, 2016, 2019, 2022, 2022 23H2, and 2025
Discovery Timeline
- 2024-11-12 - CVE-2024-43635 published to NVD
- 2024-11-12 - Microsoft releases security update via the Microsoft CVE-2024-43635 Advisory
- 2024-11-18 - Last updated in NVD database
Technical Details for CVE-2024-43635
Vulnerability Analysis
The vulnerability resides in the Windows Telephony Service, the component responsible for handling Telephony Application Programming Interface (TAPI) calls on Windows systems. The CWE-190 classification indicates that an arithmetic operation produces a value outside the expected range, leading to undersized allocations or out-of-bounds memory access during subsequent processing.
An attacker can trigger the flawed code path by sending crafted input to the service through a supported telephony interface. Because the attack vector is networked and authentication is not required, internet-exposed or laterally reachable systems are at elevated risk once a user interacts with attacker-controlled content. According to the EPSS model, the probability of observed exploitation in the next 30 days places this CVE in the upper percentile of monitored vulnerabilities.
Root Cause
The root cause is an integer overflow [CWE-190] in size or length calculations performed by the Telephony Service. When the overflowed value is used to allocate or index a buffer, subsequent writes corrupt adjacent memory. This memory corruption is the primitive an attacker leverages to redirect execution into controlled data.
Attack Vector
Exploitation requires a victim to perform an action that causes their system to process attacker-supplied telephony data. The attacker submits malformed TAPI payloads designed to trigger the integer overflow. Successful exploitation grants code execution within the Telephony Service context, which can then be used as a foothold for lateral movement or privilege escalation.
No public proof-of-concept code or exploit module has been published for this CVE at the time of writing, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Detection Methods for CVE-2024-43635
Indicators of Compromise
- Unexpected crashes or restarts of the TapiSrv service or its host process svchost.exe running with the NetworkService identity.
- New or unusual child processes spawned by the Telephony Service host process.
- Outbound network connections originating from the Telephony Service host process to untrusted destinations.
- Creation of persistence artifacts (scheduled tasks, services, registry Run keys) immediately following Telephony Service activity.
Detection Strategies
- Monitor Windows Error Reporting (WER) and the Application event log for faulting modules associated with tapisrv.dll or related telephony components.
- Hunt for process lineage anomalies where the svchost.exe instance hosting the Telephony Service launches command interpreters such as cmd.exe, powershell.exe, or rundll32.exe.
- Correlate failed authentication or RPC events directed at telephony endpoints with subsequent service crashes.
Monitoring Recommendations
- Enable Sysmon process creation (Event ID 1) and image load (Event ID 7) logging on Windows endpoints and servers.
- Forward Telephony Service crash events and Windows Defender behavioral alerts to a centralized analytics platform for correlation.
- Track RPC endpoint exposure on perimeter and internal networks and alert on unexpected connections to the Telephony Service.
How to Mitigate CVE-2024-43635
Immediate Actions Required
- Apply the Microsoft November 2024 security updates to every affected Windows client and server build listed in the Microsoft CVE-2024-43635 Advisory.
- Inventory systems still running Windows Server 2008, 2008 R2, and 2012, which require Extended Security Updates (ESU) to receive this fix.
- Restrict inbound RPC and TAPI traffic from untrusted networks using host-based and perimeter firewalls.
Patch Information
Microsoft published patches for all affected Windows client and server versions on November 12, 2024. Administrators should consult the Microsoft CVE-2024-43635 Advisory to identify the correct KB article for each operating system build and validate deployment through Windows Update, WSUS, or Microsoft Update Catalog.
Workarounds
- Disable the Windows Telephony Service (TapiSrv) on systems that do not require it, after validating no dependent applications rely on TAPI functionality.
- Block inbound RPC traffic to telephony endpoints at the network boundary and segment legacy systems that cannot be patched immediately.
- Enforce least privilege and application allow-listing so that any code executed in the Telephony Service context has limited ability to persist or move laterally.
# Configuration example: disable the Telephony Service if not in use
sc.exe config TapiSrv start= disabled
sc.exe stop TapiSrv
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
