CVE-2026-42912: Windows Telephony Service Privilege Escalation

CVE-2026-42912 Overview

CVE-2026-42912 is a race condition vulnerability in the Windows Telephony Service. The flaw arises from concurrent execution using a shared resource without proper synchronization, classified under [CWE-362]. An authenticated local attacker can exploit the timing window to elevate privileges on an affected Windows host.

Microsoft published the advisory on June 9, 2026. Exploitation requires local access and low privileges, but the attack complexity is high because the attacker must reliably win a narrow timing race. Successful exploitation impacts confidentiality, integrity, and availability.

Critical Impact
A successful race-win allows a low-privileged local user to elevate to higher privileges on the host, enabling persistence, credential theft, or installation of additional payloads.

Affected Products

Microsoft Windows (Telephony Service component)
See the Microsoft CVE-2026-42912 Advisory for the full product and build list
Refer to Microsoft's Security Update Guide for affected Windows Server SKUs

Discovery Timeline

2026-06-09 - CVE-2026-42912 published to NVD
2026-06-09 - Microsoft publishes security advisory
2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-42912

Vulnerability Analysis

The Windows Telephony Service (TapiSrv) brokers telephony API requests for clients and manages shared state on behalf of multiple callers. The vulnerability stems from concurrent execution paths that access a shared resource without enforcing correct synchronization, matching the [CWE-362] race condition pattern.

When two operations interleave during the unprotected window, an attacker can manipulate the shared resource between the time it is validated and the time it is used. This creates a Time-of-Check to Time-of-Use (TOCTOU) condition. The attacker substitutes attacker-controlled data into a code path that executes in a higher privilege context.

Because the Telephony Service runs with elevated privileges, winning the race yields code execution or resource access at a privilege level above the caller. The advisory rates impact to confidentiality, integrity, and availability as high.

Root Cause

The root cause is missing or insufficient locking around a shared object accessed by concurrent Telephony Service threads. An attacker who triggers two operations in parallel can change the state of that object between validation and use, bypassing security checks that assume serialized access.

Attack Vector

Exploitation requires local access and a valid low-privileged account on the target host. The attacker invokes Telephony Service interfaces from two threads or processes and races them against the service's internal state machine. High attack complexity reflects the timing precision and repeated attempts typically required to win the race reliably.

No verified public proof-of-concept code is available at the time of writing. See the Microsoft CVE-2026-42912 Advisory for vendor-provided technical detail.

Detection Methods for CVE-2026-42912

Indicators of Compromise

Unexpected child processes spawned by svchost.exe hosting the Telephony Service (TapiSrv)
Abnormal crashes or access violations logged against the Telephony Service in the Windows Application or System event logs
Local accounts performing high-frequency, repeated calls into telephony APIs in short bursts consistent with race-condition brute-forcing

Detection Strategies

Monitor for token manipulation or privilege elevation events originating from non-administrative user sessions on endpoints
Alert on standard users invoking telephony management APIs or loading tapi32.dll and tapisrv.dll in unusual patterns
Correlate Telephony Service restarts with subsequent process creation events running as SYSTEM from user-writable paths

Monitoring Recommendations

Enable Windows Security event auditing for process creation (Event ID 4688) and token assignment (Event ID 4672)
Ingest Telephony Service crash dumps and service restart events into a central log platform for correlation
Track Sysmon Event ID 1 (process creation) and Event ID 10 (process access) targeting svchost.exe -k NetworkService hosting the Telephony Service

How to Mitigate CVE-2026-42912

Immediate Actions Required

Apply Microsoft's June 2026 security updates referenced in the Microsoft CVE-2026-42912 Advisory to all affected Windows systems
Inventory hosts running the Telephony Service and prioritize patching on multi-user systems such as Remote Desktop Session Hosts and Citrix servers
Restrict interactive logon rights to reduce the population of accounts that meet the local, authenticated precondition

Patch Information

Microsoft has released a security update addressing CVE-2026-42912. The patch is distributed through standard Windows Update channels and the Microsoft Update Catalog. Consult the Microsoft CVE-2026-42912 Advisory for the specific KB article and build numbers applicable to each Windows version.

Workarounds

Disable the Telephony Service (TapiSrv) on systems that do not require telephony functionality, after validating application dependencies
Apply application control policies (Windows Defender Application Control or AppLocker) to block unauthorized binaries from invoking telephony APIs
Limit local account creation and enforce least privilege so fewer users can meet the local authenticated precondition

bash

# Disable the Telephony Service where not required (run as Administrator)
sc.exe config TapiSrv start= disabled
sc.exe stop TapiSrv