OnlyPatch
Windows Telephony Service

CVE-2026-25188 — Windows Telephony Service Elevation of Privilege Vulnerability

Important CVSS 8.8 EPSS 0.00552 🔬 Patch diffed 2026-03 archive

Executive Summary

Heap-based buffer overflow in Windows Telephony Service allows an unauthorized attacker to elevate privileges over an adjacent network.

Overview

8.8
CVSS HIGH
Important
MS Severity
Not Exploited
MS Exploit Status
Exploitation Unlikely
MS Exploit Likelihood
Category Elevation of Privilege
Weakness CWE-122: Heap-based Buffer Overflow
Released Mar 10 2026
Last Updated Mar 10 2026
Publicly Disclosed No
CISA KEV Not Listed
Known Exploits None Known
EPSS Score 0.00552 — 0.43389 percentile
NVD CVSS 8.8 HIGH — matches MSRC

CVSS Vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
ATTACK VECTOR
Adjacent_network
ATTACK COMPLEXITY
Low
PRIVILEGES REQUIRED
None
USER INTERACTION
None
SCOPE
Unchanged
CONFIDENTIALITY
High
INTEGRITY
High
AVAILABILITY
High
EXPLOIT CODE MATURITY
Unproven
REMEDIATION LEVEL
Official Fix
REPORT CONFIDENCE
Confirmed
Temporal Score: 7.7

EPSS Score

0.00552
probability of exploitation in the next 30 days
0.43389 percentile - updated 2026-08-14
View on FIRST.org

Affected Products

23 affected products
Product KB Article Severity Impact Restart Required
Windows 10 Version 1607 for 32-bit Systems 5078938 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 1607 for x64-based Systems 5078938 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 1809 for 32-bit Systems 5078752 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 1809 for x64-based Systems 5078752 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 21H2 for 32-bit Systems 5078885 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 21H2 for ARM64-based Systems 5078885 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 21H2 for x64-based Systems 5078885 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 22H2 for 32-bit Systems 5078885 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 22H2 for ARM64-based Systems 5078885 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 22H2 for x64-based Systems 5078885 (Security Update) Important Elevation of Privilege Yes
Windows 11 Version 23H2 for ARM64-based Systems 5078883 (Security Update) Important Elevation of Privilege Yes
Windows 11 Version 23H2 for x64-based Systems 5078883 (Security Update) Important Elevation of Privilege Yes
Windows 11 Version 24H2 for ARM64-based Systems 5079473 (Security Update) 5079420 (Security Hotpatch Update) Important Elevation of Privilege 5077181 5077212 Base: 8.8 Temporal: 7.7 Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 10.0.26100.8037 10.0.26100.7979 Yes None Windows 11 Version 24H2 for x64-based Systems 5079473 (Security Update) 5079420 (Security Hotpatch Update) Important Elevation of Privilege 5077181 5077212 Base: 8.8 Temporal: 7.7 Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 10.0.26100.8037 10.0.26100.7979 Yes None Windows 11 Version 25H2 for ARM systems 5079473 (Security Update) 5079420 (Security Hotpatch Update) Important Elevation of Privilege 5077181 5077212 Base: 8.8 Temporal: 7.7 Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 10.0.26200.8037 10.0.26200.7979 Yes None Windows 11 Version 25H2 for x64-based Systems 5079473 (Security Update) 5079420 (Security Hotpatch Update) Important Elevation of Privilege 5077181 5077212 Base: 8.8 Temporal: 7.7 Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 10.0.26200.8037 10.0.26200.7979 Yes None Windows 11 Version 26H1 for ARM64-based Systems 5079466 (Security Update) Important Elevation of Privilege Yes
Windows 11 version 26H1 for x64-based Systems 5079466 (Security Update) Important Elevation of Privilege Yes
Windows Server 2012 5078775 (Monthly Rollup) Important Elevation of Privilege Yes
Windows Server 2012 (Server Core installation) 5078775 (Monthly Rollup) Important Elevation of Privilege Yes
Windows Server 2012 R2 5078774 (Monthly Rollup) Important Elevation of Privilege Yes
Windows Server 2012 R2 (Server Core installation) 5078774 (Monthly Rollup) Important Elevation of Privilege Yes
Windows Server 2016 5078938 (Security Update) Important Elevation of Privilege Yes
Windows Server 2016 (Server Core installation) 5078938 (Security Update) Important Elevation of Privilege Yes
Windows Server 2019 5078752 (Security Update) Important Elevation of Privilege Yes
Windows Server 2019 (Server Core installation) 5078752 (Security Update) Important Elevation of Privilege Yes
Windows Server 2022 5078766 (Security Update) 5078737 (Security Hotpatch Update) Important Elevation of Privilege 5075906 5075943 Base: 8.8 Temporal: 7.7 Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 10.0.20348.4893 10.0.20348.4830 Yes No None Windows Server 2022 (Server Core installation) 5078766 (Security Update) 5078737 (Security Hotpatch Update) Important Elevation of Privilege 5075906 5075943 Base: 8.8 Temporal: 7.7 Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 10.0.20348.4893 10.0.20348.4830 Yes No None Windows Server 2022, 23H2 Edition (Server Core installation) 5078734 (Security Update) Important Elevation of Privilege Yes

Patches

8 patches
Article Type Restart
5078938 Security Update Yes
5078752 Security Update Yes
5078885 Security Update Yes
5078883 Security Update Yes
5079466 Security Update Yes
5078775 Monthly Rollup Yes
5078774 Monthly Rollup Yes
5078734 Security Update Yes

Patch Diff

ghidriff · tapisrv.dll (KB5079473)

Heap-based buffer overflow (CWE-122) in the Windows Telephony Service (tapisrv.dll) LForward, the server-side handler for lineForward. LForward parses a client-supplied LINEFORWARDLIST (header + array of LINEFORWARD entries, each with variable-length caller/callee address blobs referenced by offset/size). It allocates a heap buffer of 2 x dwTotalSize (the client-declared list size) and copies the list in, widening embedded ANSI address strings to Unicode. Each entry's caller/callee block is validated INDIVIDUALLY with IsBadSizeOffset, but the CUMULATIVE size of all entries' variable-length address data is never checked against the allocation. A crafted list whose entries each pass the per-entry check but whose aggregate (or ANSI->Unicode-widened, or overlapping/aliased-offset) address data exceeds 2 x dwTotalSize overflows the tapisrv service heap (ghTapisrvHeap) with attacker-controlled bytes - a local EoP. IN-HOUSE ghidriff diff of 10.0.26100.7623 -> .8036 shows LForward is the only function with a real code change; the March fix adds an integer-overflow-checked cumulative size accumulator validated against dwTotalSize, GATED behind CFR flag Feature_3967746362 - with the flag off the patched binary still runs the per-entry-only validation and remains overflowable. Credit: h4urek.

Pre-patch version 10.0.26100.7623 Download
Post-patch version 10.0.26100.8036 Download
Function Address Change Note
LForward 18000a750 -> 18000a790 code (cumulative size validation added, CFR-gated) Pre-patch validates each LINEFORWARD entry's caller/callee address block individually via IsBadSizeOffset but never sums them; allocation is HeapAlloc(ghTapisrvHeap,8,dwTotalSize*2). Post-patch adds Feature_3967746362__private_IsEnabledDeviceUsageNoInline() checks at 3 sites that accumulate each entry's CallerSize/CalleeSize into a running total (local_c4) with 32-bit add-overflow checks and reject when the total exceeds dwTotalSize (handles the aliased caller==callee case specially). Length 1502 -> 1656; match ratio 0.25/b_ratio 0.37. The cumulative check runs only when the flag is enabled.
Feature_3967746362__private_IsEnabledDeviceUsageNoInline 18000699c (new) added (CFR flag accessor) New Controlled Feature Rollout flag accessor introduced by this patch and called only from LForward. Gates the cumulative-size bounds check.
View full diff report View RCA report

Attack Path

Per-entry-only validation lets a LINEFORWARDLIST's aggregate address data overflow a 2 x dwTotalSize heap buffer in the Telephony service

Attack path for CVE-2026-25188 Per-entry-only validation lets a LINEFORWARDLIST's aggregate address data overflow a 2 x dwTotalSize heap buffer in the Telephony service 01 — ENTRY Local user opens the TAPI client interface and calls lineForward tapi32!lineForward marshals the request over TAPI RPC/ALPC to the tapisrv service (svchost). No admin rights; the service runs privileged, so corruption there is an EoP primitive. 02 — CONTROLLED INPUT Supplies a crafted LINEFORWARDLIST (header + LINEFORWARD entries) The client controls dwTotalSize, the entry count, and each entry's caller/callee address offset+size pairs into the same buffer - all fully attacker-chosen. 03 — PATH LForward allocates 2 x dwTotalSize and copies the list, widening ANSI addresses to Unicode HeapAlloc(ghTapisrvHeap, 8, dwTotalSize*2). NewToOld/OldToNewLineforwardlist expand each entry's address strings via MultiByteToWideChar into the buffer. 04 — MISSING CHECK Each entry is bounds-checked alone; the cumulative address size is never checked IsBadSizeOffset only proves a single entry's offset+size fits dwTotalSize. Nothing sums all entries' variable-length address data. Overlapping/aliased offsets keep dwTotalSize small while the written (widened) total grows past 2 x dwTotalSize. 05 — PRIMITIVE Controlled heap overflow in ghTapisrvHeap -> local elevation of privilege Attacker-controlled widened address bytes overrun the allocation in the privileged Telephony service. The March 2026 patch adds a cumulative, overflow-checked size accumulator validated against dwTotalSize - but gated behind CFR flag Feature_3967746362.

Derived from the patch delta: the checks added by the vendor identify which fields crossed a trust boundary unvalidated. Reachability and privilege are taken from the call chain in the RCA report.

Known Exploits

Acknowledgments

h4urek

On This Page