CVE-2026-42912: Windows Telephony Service Elevation of Privilege Vulnerability

Synopsis

A race condition in the Windows Telephony Service allows a locally authenticated attacker to elevate privileges on affected Windows 10 and Windows 11 systems. The attacker must already hold a low-privilege account on the host and exploit a timing window in how the service handles shared resources; no network access or victim interaction is required. Successful exploitation gives the attacker full control over confidentiality, integrity, and availability of the affected system. Patched-image rebuilds at the fix versions are available on HarborGuard for environments running affected Windows base images.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network-facing exposure is required to trigger the vulnerability.

• AuthenticationRequired

  Any low-privilege local account is sufficient; no administrative rights are needed to attempt exploitation.

• Victim interactionNot required

  The attacker can trigger the race condition without any action from another user or administrator on the system.

• Attack complexityDetail

  Exploitation depends on winning a race condition tied to shared-resource timing, which introduces environmental variability and makes reliable exploitation harder.

Blast Radius

• A successful attacker reads protected system data and credentials held by higher-privileged processes.
• A successful attacker writes to or modifies system files, registry keys, and other protected resources normally restricted to SYSTEM or administrator-level processes.
• A successful attacker can crash or destabilize system services, causing loss of availability for the host.
• Combined control over confidentiality, integrity, and availability effectively gives the attacker full local system compromise.