Loading vulnerability…
Windows Telephony Service Use-After-Free Privilege Escalation
CVE-2026-42825 is an elevation-of-privilege vulnerability in the Windows Telephony Service caused by a use-after-free condition. The flaw can be triggered by a local authorized attacker and requires successful exploitation of a race condition. Microsoft rates the issue as Important and assigns CVSS v3.1 7.0 with vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. Successful exploitation can result in execution in a highly privileged context, specifically allowing the attacker to obtain SYSTEM privileges.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows a local attacker with low privileges to elevate privileges to SYSTEM. Because the CVSS impact metrics are high for confidentiality, integrity, and availability, compromise of the vulnerable service can enable full takeover of the affected host, including access to sensitive data, modification of protected resources, installation or execution of privileged code, and disruption of system operation.
If you can’t patch tonight, do this now.
No separate vendor workaround is available in the provided information. Mitigation is therefore limited to reducing local attack opportunities until patches are applied, such as restricting local logon and code execution by untrusted users and minimizing exposure of affected systems to low-privileged accounts.
Patch, then assume compromise.
Apply the official Microsoft security update released for CVE-2026-42825 as part of the May 2026 security updates for affected Windows platforms. Prioritize patching systems where local untrusted users can execute code, since the vulnerability is a local elevation-of-privilege issue in the Windows Telephony Service.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.