CVE-2026-42968: Windows Telephony Information Disclosure

CVE-2026-42968 Overview

CVE-2026-42968 is an out-of-bounds read vulnerability in the Windows Telephony Service. An authorized local attacker can exploit the flaw to disclose information from process memory. Microsoft documented the issue in its Security Update Guide, and the National Vulnerability Database (NVD) classifies it under CWE-125: Out-of-bounds Read.

The issue is local in nature, requires low privileges, and does not need user interaction. Successful exploitation impacts confidentiality only, with no effect on integrity or availability.

Critical Impact
An authenticated local attacker can read memory contents outside the intended buffer, potentially exposing sensitive data handled by the Telephony Service such as call control structures, handles, or fragments of adjacent process memory.

Affected Products

Microsoft Windows (Telephony Service component)
Refer to the Microsoft CVE-2026-42968 Update Guide for the authoritative list of affected builds
Workstation and server SKUs running the Telephony Service (tapisrv.dll)

Discovery Timeline

2026-06-09 - CVE-2026-42968 published to NVD
2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-42968

Vulnerability Analysis

The Windows Telephony Service (tapisrv.dll) brokers Telephony Application Programming Interface (TAPI) requests between user-mode clients and telephony service providers. The service handles call control, line and phone device enumeration, and message routing. CVE-2026-42968 stems from an out-of-bounds read [CWE-125] inside this service when it processes attacker-influenced input from a local caller.

When the service reads past the bounds of an allocated buffer, it returns memory contents that were not intended to be disclosed. Because Telephony Service runs with elevated privileges, the leaked bytes can include data that an unprivileged caller could not otherwise observe. The flaw affects confidentiality only, consistent with a read-side memory safety bug that does not allow modification or service disruption.

Root Cause

The root cause is missing or insufficient length validation on a buffer read inside the Telephony Service. The service trusts a size or offset value derived from the caller's request and reads beyond the allocated structure. This pattern matches classic [CWE-125] defects in Windows RPC-style services where input-driven indexing is not clamped to the buffer length.

Attack Vector

An attacker needs an authenticated local session with low privileges. The attacker crafts a TAPI request that triggers the vulnerable code path in tapisrv.dll and harvests the returned memory contents. No user interaction is required, and the attack does not cross a security boundary beyond the local host. Repeated invocation can be used to scrape additional memory fragments and reconstruct sensitive material such as pointers, tokens, or session data useful for chaining into a privilege escalation primitive.

No public proof-of-concept exploit is available at the time of publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is 0.051% (percentile 16.3), reflecting a low predicted likelihood of near-term exploitation.

Detection Methods for CVE-2026-42968

Indicators of Compromise

Unusual local processes opening handles to the Telephony Service or loading tapi32.dll outside of expected telephony workflows
Repeated TAPI requests from a single low-privileged user account in a short time window, consistent with memory-scraping behavior
Crashes or anomalous error returns from svchost.exe instances hosting tapisrv.dll

Detection Strategies

Hunt for non-telephony applications invoking TAPI functions such as lineOpen, lineGetID, or lineNegotiateAPIVersion against the local service
Correlate process creation events with subsequent loads of tapi32.dll to identify unexpected client processes
Apply behavioral analytics to flag low-privileged user contexts performing repeated calls into Windows service RPC interfaces

Monitoring Recommendations

Enable Windows Event Tracing for Windows (ETW) providers covering RPC and service activity, and forward events to a central analytics platform
Monitor svchost.exe -k NetworkService instances that host the Telephony Service for abnormal child process activity or memory access patterns
Track patch deployment status for Windows endpoints against the Microsoft Security Update Guide to identify unpatched hosts

How to Mitigate CVE-2026-42968

Immediate Actions Required

Apply the Microsoft security update referenced in the CVE-2026-42968 Update Guide to all affected Windows systems
Prioritize multi-user systems such as Remote Desktop Session Hosts and Virtual Desktop Infrastructure (VDI) hosts where local authenticated users are most numerous
Audit local account inventories and remove unnecessary interactive logon rights

Patch Information

Microsoft has published guidance and updates through the Microsoft Security Response Center (MSRC). Refer to the Microsoft CVE-2026-42968 Update Guide for the specific KB articles, build numbers, and applicable Windows versions. Deploy the updates through Windows Update, Windows Server Update Services (WSUS), Microsoft Configuration Manager, or Intune according to your standard patching cycle.

Workarounds

Where the Telephony Service is not required, set the Tapisrv service Start value to Disabled and stop the service
Restrict local logon rights on servers that do not require interactive user sessions, reducing the population able to reach the local attack surface
Apply the principle of least privilege so that standard users cannot run arbitrary code that interacts with TAPI on sensitive hosts

bash

# Disable the Telephony Service where not required (run as Administrator)
sc.exe stop TapiSrv
sc.exe config TapiSrv start= disabled

# Verify status
sc.exe query TapiSrv