PT-2026-2734 · Microsoft · Windows Telephony Service+1

Sergey Bliznyuk · Publicado 2026-01-13 · Atualizado 2026-05-26 · CVE-2026-20931

Positive Technologies (AI Summary)

CVSS v3.1

8.0

Alta

Vetor base

AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Windows Telephony Service (affected versions not specified)

Description An elevation-of-privilege issue exists in the Windows Telephony Service due to improper external control of file names or paths. Successful exploitation may allow an authorized attacker to elevate privileges over an adjacent network and affect the system. The vulnerability was discovered by Sergey Bliznyuk and addressed by Microsoft in January 2026. The issue is also described as an authenticated Remote Code Execution (RCE).

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

LPE

RCE

Enumeração de Fraquezas

CWE-73

Identificadores relacionados

BDU:2026-00310

CVE-2026-20931

Produtos afetados

Windows

Windows Telephony Service

Referências · 16

• https://t.me/cveNotify/164729 · Publicação no Telegram
• https://twitter.com/0patch/status/2047002397407420715 · Publicação no Twitter
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20931 · Aviso do Fabricante
• https://vicarius.io/vsociety/posts/cve-2026-20931-detection-script-elevation-of-privilege-vulnerability-in-windows-telephony-service · Nota
• https://t.me/RalfHackerChannel/1655 · Publicação no Telegram
• https://twitter.com/leonov_av/status/2011182019628167593 · Publicação no Twitter
• https://vicarius.io/vsociety/posts/cve-2026-20931-mitigation-script-elevation-of-privilege-vulnerability-in-windows-telephony-service · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-20931 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-20931 · Nota de Segurança
• https://bdu.fstec.ru/vul/2026-00310 · Nota de Segurança
• https://twitter.com/CVEnew/status/2011181507977887837 · Publicação no Twitter
• https://reddit.com/r/SecOpsDaily/comments/1sst7ab/micropatches_released_for_windows_telephony · Publicação no Reddit
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-20931 · Aviso do Fabricante
• https://twitter.com/_patchpoint_/status/2015640553141260647 · Publicação no Twitter
• https://reddit.com/r/SecOpsDaily/comments/1sst84r/secopsdaily_20260422_roundup · Publicação no Reddit