A critical heap-based buffer overflow in the Windows Telephony Service enables unauthorized attackers to elevate privileges, posing a significant risk to system integrity.

This vulnerability is a heap-based buffer overflow (CWE-122) located in the Windows Telephony Service. An unauthenticated attacker positioned on an adjacent network can trigger this flaw to execute code with elevated privileges.

Successful exploitation of this vulnerability allows an attacker to gain elevated privileges on an affected system, which can lead to complete system compromise, unauthorized data access, and potential lateral movement within the network. With a CVSS score of 8.8, this vulnerability is categorized as High severity, reflecting the significant risk to confidentiality, integrity, and availability of host systems.

Immediate Action: Administrators must apply the latest security updates provided by Microsoft in the March 2026 Patch Tuesday cycle to all affected Windows versions.

Proactive Monitoring: Security teams should monitor system logs for unusual crashes related to the Telephony Service (tapisrv) or unexpected elevation of privilege events.

Compensating Controls: Restrict network access to the affected service by implementing host-based firewall rules to block unauthorized traffic from the adjacent network segment.

Public Exploit Available: Unknown.

Given the potential for privilege escalation and the high CVSS severity rating, this vulnerability should be prioritized for immediate remediation. Organizations should verify their current Windows build numbers against the affected ranges provided and ensure that all systems are updated to the specified patched builds to eliminate this risk.