Loading story…
Researchers detailed CVE-2024-26230, an elevation-of-privilege flaw in the Microsoft Windows Telephony Service (TapiSrv) caused by a use-after-free in tapisrv.dll. The bug can be exploited by shaping heap allocations with user-controlled registry data under Telephony\HandoffPriorities, reclaiming freed memory with a fake object, and triggering TUISPIDLLCallback to gain code execution inside the service process. The reported exploit path yields execution as NT AUTHORITY\Network Service and can then be chained with PrintSpoofer to reach SYSTEM because the service token carries SeImpersonatePrivilege.
The research also highlighted CVE-2024-43626, a related Telephony Service issue in GetPriorityList and SetPriorityList tied to improper handling of non-null-terminated registry strings, which can lead to out-of-bounds reads, writes, and information leakage. Microsoft reportedly addressed CVE-2024-43626 in the November 12, 2024 security updates by explicitly null-terminating the string and adding an integer overflow check on cbData. Recommended defenses include applying Microsoft patches, restricting normal users from starting the Telephony service, and monitoring for unexpected Telephony service crashes.
Get the actors, campaigns, and ATT&CK mapping behind it.
2 events from the most recent confirmed update back to the earliest known activity.
STAR Labs published a detailed write-up of CVE-2024-26230, describing a use-after-free in the Windows Telephony Service that can be exploited for elevation of privilege. The analysis showed how attacker-controlled Telephony registry data could shape heap allocations, achieve code execution as Network Service, and potentially escalate to SYSTEM via PrintSpoofer.
Microsoft fixed the related Windows Telephony Service flaw CVE-2024-43626 in its November 12, 2024 security updates. The patch explicitly null-terminated the affected string handling and added an integer overflow check on cbData.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
starlabs.sg
Open sourcestarlabs.sg
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple public write-ups detailed how Windows service and RPC design flaws enabled **local privilege escalation**, **sandbox escape**, and in some cases reliable code execution. Research on the Windows SSDP service linked `FC_BINDING_CONTEXT` misuse to **CVE-2025-48815**, showing that a context handle from one RPC interface could be passed into another interface expecting a different type and ultimately abused to call `CloseHandle` on an unintended handle. Separate analysis of the Windows telephony service described **CVE-2024-26230** as a use-after-free in `tapisrv` caused by improper ownership validation of RPC-managed objects, allowing a dangling pointer to be reclaimed with attacker-controlled data and steered toward `LoadLibraryW` despite **XFG** protections. Earlier Windows RPC research also covered Storage Service bugs **CVE-2019-0983** and **CVE-2019-0998**, where file-copy, directory, and ACL logic exposed through RPC could be abused to overwrite privileged files or alter their security descriptors. Other disclosures showed the same pattern across Windows subsystems. Analysis of **CVE-2022-22715** in `npfs.sys` demonstrated that malformed `LOCAL\` named pipe paths could trigger integer overflow and out-of-bounds kernel writes, enabling escape from the Adobe Reader **AppContainer** sandbox and escalation to kernel read/write. Research into **CVE-2021-1648** in `splwow64` described bypasses in printer-handle validation and an arbitrary address read, while older work on **CVE-2018-8550** examined COM `DfMarshal` abuse for elevation of privilege through privileged unmarshaling paths. Related reporting also highlighted Microsoft hard-link mitigations and a Citrix restricted-desktop breakout that relied on allowed scripting components rather than a zero-day, underscoring how weak validation, unsafe object handling, and incomplete execution controls repeatedly exposed high-impact privilege boundaries on Windows.
Aug 3, 2026
Microsoft released fixes for several **Windows elevation-of-privilege vulnerabilities** affecting **Win32k**, **Windows Telephony Service**, **Desktop Window Manager**, and the **Windows Cloud Files Mini Filter Driver**. The disclosed flaws include `CVE-2026-34347`, `CVE-2026-42825`, `CVE-2026-27923`, and `CVE-2026-35418`, and are all tied to **use-after-free** conditions, with some cases also involving race conditions such as time-of-check time-of-use behavior. Microsoft said successful exploitation could let a locally authenticated attacker with low privileges gain **SYSTEM** access without user interaction. The vulnerabilities were rated **Important** with **CVSS 3.1 scores ranging from 7.0 to 7.8**, and Microsoft assessed exploitation as **less likely or unlikely** because several attacks require winning a race condition. At the time of disclosure, Microsoft reported **no public disclosure and no evidence of active exploitation** for the documented 2026 flaws, and stated that official security updates were available. Additional Microsoft advisories also reference related Windows and Microsoft Brokering File System elevation-of-privilege issues, including `CVE-2026-24285`, `CVE-2025-32712`, `CVE-2025-21372`, `CVE-2025-21315`, and `CVE-2025-59189`, though public technical details for those entries were limited.
Jun 29, 2026
Microsoft published security updates for a series of Windows elevation-of-privilege vulnerabilities affecting components including **Core Messaging**, **CSC Service**, **Cryptographic Services**, **Win32k**, and the **COM+ Event System Service**. The referenced flaws include `CVE-2025-21378`, `CVE-2025-21184`, `CVE-2025-21414`, `CVE-2025-26634`, `CVE-2025-49727`, `CVE-2025-58725`, and `CVE-2025-62458`, indicating a broad set of local privilege-escalation issues across core Windows subsystems. Among them, Microsoft provided additional detail for `CVE-2026-40377`, an **Important** vulnerability in Microsoft Cryptographic Services caused by a heap-based buffer overflow. Microsoft said a locally authorized attacker with low privileges could exploit the flaw to gain **SYSTEM** privileges without user interaction; the issue received a **CVSS 3.1 score of 7.8**, was assessed as **less likely** to be exploited, and was **not publicly disclosed or exploited** at the time of publication. Microsoft said a fix was available and credited **Bruce Dang of Calif.io** for reporting the bug.
Jul 12, 2026