CVE-2026-59122: Windows 10 1607 Privilege Escalation Flaw

CVE-2026-59122 Overview

CVE-2026-59122 is a race condition vulnerability in the Windows Telephony Service that allows an authenticated local attacker to elevate privileges. The flaw results from concurrent execution using a shared resource with improper synchronization [CWE-362]. An attacker who successfully wins the race can execute code in the context of a higher-privileged process. Microsoft rates the issue as HIGH severity across supported Windows client and server editions.

Critical Impact
Successful exploitation grants an authorized local attacker elevated privileges on the target system, compromising confidentiality, integrity, and availability.

Affected Products

Microsoft Windows 10 (1607, 1809, 21H2, 22H2)
Microsoft Windows 11 (23H2, 24H2, 25H2, 26H1)
Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025

Discovery Timeline

2026-08-11 - CVE-2026-59122 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-59122

Vulnerability Analysis

The Windows Telephony Service (TapiSrv) manages telephony application programming interface (TAPI) requests across processes. The service accesses shared resources without adequate synchronization primitives between concurrent threads. An authenticated attacker running low-privileged code on the machine can trigger multiple simultaneous requests. When timing aligns, the attacker manipulates a shared object between validation and use, corrupting service state. The resulting condition allows arbitrary operations under the SYSTEM security context. Exploitation requires local access and careful timing, reflected in the high attack complexity rating.

Root Cause

The defect is a classic time-of-check to time-of-use (TOCTOU) pattern within the Telephony Service. A shared resource is inspected under one lock state, then acted upon after that state can be altered by a competing thread. Missing or incorrect synchronization allows the attacker's thread to substitute or modify the resource between the check and the use.

Attack Vector

The attacker must already hold valid low-privileged credentials on the target host. From that foothold, the attacker launches parallel threads that invoke Telephony Service RPC or IOCTL endpoints while manipulating handle state. Winning the race yields SYSTEM-level code execution. No user interaction is required. The vulnerability is not exposed remotely, and no public proof-of-concept exploit has been observed at publication.

No verified exploit code is publicly available. See the Microsoft Security Update Guide for vendor technical details.

Detection Methods for CVE-2026-59122

Indicators of Compromise

Unexpected child processes spawned by svchost.exe hosting the Telephony Service (TapiSrv).
Abnormal loading of TAPI-related modules (tapi32.dll, tapisrv.dll) by non-telephony applications.
Local user processes issuing bursts of concurrent RPC calls to the Telephony Service endpoint.

Detection Strategies

Monitor for privilege transitions where a standard user process is followed by SYSTEM-context activity originating from svchost.exe -k NetworkService.
Alert on repeated crashes or restarts of the Telephony Service, which may indicate race-condition exploitation attempts.
Correlate process creation events (Sysmon Event ID 1) with token elevation events (Windows Event ID 4672) tied to unexpected parents.

Monitoring Recommendations

Ingest Windows Security, Sysmon, and RPC telemetry into a central analytics platform for cross-event correlation.
Track the Telephony Service state and startup type; flag hosts where the service transitions from Manual to Automatic without administrative change tickets.
Baseline normal TAPI usage per host; investigate deviations from workstations that do not use telephony features.

How to Mitigate CVE-2026-59122

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide to all affected Windows client and server systems.
Prioritize patching on multi-user systems such as terminal servers, jump hosts, and shared workstations where local users are more likely to attempt privilege escalation.
Audit local account membership and remove unnecessary interactive logon rights to reduce the population of potential attackers.

Patch Information

Microsoft released fixes as part of the monthly security update cycle. Consult the Microsoft Security Update Guide for the specific KB article and cumulative update applicable to each Windows version. Install the latest cumulative update; no standalone patch is required.

Workarounds

Disable the Telephony Service (TapiSrv) on systems that do not use TAPI functionality, using sc.exe config TapiSrv start= disabled followed by sc.exe stop TapiSrv.
Restrict local logon rights through Group Policy so that only trusted administrative accounts can execute code on affected hosts.
Enable attack surface reduction rules and application allowlisting to block untrusted binaries from invoking privileged service endpoints.

bash

# Disable Windows Telephony Service where not required
sc.exe stop TapiSrv
sc.exe config TapiSrv start= disabled