OnlyPatch
Windows Remote Access Connection Manager

CVE-2024-26230 — Windows Telephony Server Elevation of Privilege Vulnerability

Important CVSS 7.8 EPSS 0.24294 🔬 Patch diffed 2024-04 archive

Executive Summary

None

Overview

7.8
CVSS HIGH
Important
MS Severity
Not Exploited
MS Exploit Status
More Likely
MS Exploit Likelihood
Category Elevation of Privilege
Weakness CWE-416: Use After Free
Released Apr 9 2024
Last Updated Apr 9 2024
Publicly Disclosed No
CISA KEV Not Listed
Known Exploits None Known
EPSS Score 0.24294 — 0.97663 percentile
NVD CVSS 7.8 HIGH — matches MSRC

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
ATTACK VECTOR
Local
ATTACK COMPLEXITY
Low
PRIVILEGES REQUIRED
Low
USER INTERACTION
None
SCOPE
Unchanged
CONFIDENTIALITY
High
INTEGRITY
High
AVAILABILITY
High
EXPLOIT CODE MATURITY
Unproven
REMEDIATION LEVEL
Official Fix
REPORT CONFIDENCE
Confirmed
Temporal Score: 6.8

EPSS Score

0.24294
probability of exploitation in the next 30 days
0.97663 percentile - updated 2026-08-14
View on FIRST.org

Affected Products

30 affected products
Product KB Article Severity Impact Restart Required
Windows 10 for 32-bit Systems 5036925 (Security Update) Important Elevation of Privilege Yes
Windows 10 for x64-based Systems 5036925 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 1607 for 32-bit Systems 5036899 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 1607 for x64-based Systems 5036899 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 1809 for 32-bit Systems 5036896 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 1809 for ARM64-based Systems 5036896 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 1809 for x64-based Systems 5036896 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 21H2 for 32-bit Systems 5036892 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 21H2 for ARM64-based Systems 5036892 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 21H2 for x64-based Systems 5036892 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 22H2 for 32-bit Systems 5036892 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 22H2 for ARM64-based Systems 5036892 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 22H2 for x64-based Systems 5036892 (Security Update) Important Elevation of Privilege Yes
Windows 11 version 21H2 for ARM64-based Systems 5036894 (Security Update) Important Elevation of Privilege Yes
Windows 11 version 21H2 for x64-based Systems 5036894 (Security Update) Important Elevation of Privilege Yes
Windows 11 Version 22H2 for ARM64-based Systems 5036893 (Security Update) Important Elevation of Privilege Yes
Windows 11 Version 22H2 for x64-based Systems 5036893 (Security Update) Important Elevation of Privilege Yes
Windows 11 Version 23H2 for ARM64-based Systems 5036893 (Security Update) Important Elevation of Privilege Yes
Windows 11 Version 23H2 for x64-based Systems 5036893 (Security Update) Important Elevation of Privilege Yes
Windows Server 2008 for 32-bit Systems Service Pack 2 5036932 (Monthly Rollup) 5036950 (Security Only) Important Elevation of Privilege 5035920 Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 6.0.6003.22618 Yes 5036932 5036950 Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation) 5036932 (Monthly Rollup) 5036950 (Security Only) Important Elevation of Privilege 5035920 Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 6.0.6003.22618 Yes 5036932 5036950 Windows Server 2008 for x64-based Systems Service Pack 2 5036932 (Monthly Rollup) 5036950 (Security Only) Important Elevation of Privilege 5035920 Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 6.0.6003.22618 Yes 5036932 5036950 Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation) 5036932 (Monthly Rollup) 5036950 (Security Only) Important Elevation of Privilege 5035920 Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 6.0.6003.22618 Yes 5036932 5036950 Windows Server 2008 R2 for x64-based Systems Service Pack 1 5036967 (Monthly Rollup) 5036922 (Security Only) Important Elevation of Privilege 5035888 Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 6.1.7601.27067 Yes None Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) 5036967 (Monthly Rollup) 5036922 (Security Only) Important Elevation of Privilege 5035888 Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 6.1.7601.27067 Yes None Windows Server 2012 5036969 (Monthly Rollup) Important Elevation of Privilege Yes
Windows Server 2012 (Server Core installation) 5036969 (Monthly Rollup) Important Elevation of Privilege Yes
Windows Server 2012 R2 5036960 (Monthly Rollup) Important Elevation of Privilege Yes
Windows Server 2012 R2 (Server Core installation) 5036960 (Monthly Rollup) Important Elevation of Privilege Yes
Windows Server 2016 5036899 (Security Update) Important Elevation of Privilege Yes
Windows Server 2016 (Server Core installation) 5036899 (Security Update) Important Elevation of Privilege Yes
Windows Server 2019 5036896 (Security Update) Important Elevation of Privilege Yes
Windows Server 2019 (Server Core installation) 5036896 (Security Update) Important Elevation of Privilege Yes
Windows Server 2022 5036909 (Security Update) Important Elevation of Privilege Yes
Windows Server 2022 (Server Core installation) 5036909 (Security Update) Important Elevation of Privilege Yes
Windows Server 2022, 23H2 Edition (Server Core installation) 5036910 (Security Update) Important Elevation of Privilege Yes

Patches

10 patches
Article Type Restart
5036925 Security Update Yes
5036899 Security Update Yes
5036896 Security Update Yes
5036892 Security Update Yes
5036894 Security Update Yes
5036893 Security Update Yes
5036969 Monthly Rollup Yes
5036960 Monthly Rollup Yes
5036909 Security Update Yes
5036910 Security Update Yes

Patch Diff

ghidriff · tapisrv.dll (KB5036892)

Use-after-free in Windows Telephony Service (tapisrv.dll). GetUIDllName creates a GOLD dialog object. FreeDialogInstance frees this object without invalidating cross-context pointers. Later TUISPIDLLCallback triggers a virtual function call on the dangling GOLD pointer, leading to arbitrary code execution. Reachable via local RPC to ncalrpc:[tapsrvlpc].

Pre-patch version 10.0.22621.3296
Post-patch version 10.0.22621.3447
Function Address Change Note
GetUIDllName modified Added proper reference counting for GOLD dialog objects
FreeDialogInstance modified Added NULLing of cross-context pointers before freeing GOLD object
TUISPIDLLCallback modified Added validation that GOLD pointer is still valid before virtual function call
View full diff report View RCA report Download PoC

Attack Path

Use-after-free on a Telephony dialog object - freed without invalidating the cross-context pointers that still reference it

Attack path for CVE-2024-26230 Use-after-free on a Telephony dialog object - freed without invalidating the cross-context pointers that still reference it 01 — ENTRY Local user connects to the Telephony Service over RPC ncalrpc:[tapsrvlpc], reachable by unprivileged local callers. tapisrv runs inside svchost as SYSTEM. 02 — CONTROLLED INPUT Attacker drives dialog creation and teardown ordering GetUIDllName creates a GOLD dialog object; the attacker controls when FreeDialogInstance runs relative to callbacks still holding it. 03 — PATH FreeDialogInstance releases the GOLD object The object is freed while other contexts still hold pointers to it. 04 — MISSING CHECK Cross-context pointers are not invalidated before the free, and the object is not refcounted The patch adds proper reference counting for GOLD dialog objects in GetUIDllName and NULLs the cross-context pointers in FreeDialogInstance before freeing. 05 — PRIMITIVE TUISPIDLLCallback makes a virtual call through the dangling GOLD pointer Controlled indirect call inside a SYSTEM service - arbitrary code execution.

Derived from the patch delta: the checks added by the vendor identify which fields crossed a trust boundary unvalidated. Reachability and privilege are taken from the call chain in the RCA report.

Known Exploits

Acknowledgments

None

On This Page