PT-2026-2734 · Microsoft · Windows Telephony Service+1

Sergey Bliznyuk · Published 2026-01-13 · Updated 2026-03-06 · CVE-2026-20931

Positive Technologies · (AI Summary)

CVSS v3.1

8.0

8.0

High

Base vector

AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Windows Telephony Service (affected versions not specified)

Description An elevation-of-privilege issue exists in the Windows Telephony Service due to improper external control of file names or paths. Successful exploitation may allow an authorized attacker to elevate privileges over an adjacent network and affect the system. The vulnerability was discovered by Sergey Bliznyuk and addressed by Microsoft in January 2026. The issue is also described as an authenticated Remote Code Execution (RCE).

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

LPE

Weakness Enumeration

CWE-73

Related Identifiers

BDU:2026-00310

CVE-2026-20931

Affected Products

Windows

Windows Telephony Service

References · 9

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20931 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-20931 · Security Note
• https://bdu.fstec.ru/vul/2026-00310 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-20931 · Security Note
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-20931 · Vendor Advisory
• https://twitter.com/leonov_av/status/2011182019628167593 · Twitter Post
• https://twitter.com/_patchpoint_/status/2015640553141260647 · Twitter Post
• https://twitter.com/CVEnew/status/2011181507977887837 · Twitter Post
• https://t.me/RalfHackerChannel/1655 · Telegram Post