CVE-2026-20931
HighCVSS 8.0Exploitation Probability (EPSS)
Elevated risk51th percentile - higher than 51% of all known CVEs
Summary
A vulnerability in the Windows Telephony Service allows an authorized attacker to elevate privileges through external control of file name or path over an adjacent network.
Risk Assessment
An attacker could gain elevated privileges, potentially leading to unauthorized access to system resources.
Recommendation
It is recommended to monitor and restrict access to the telephony service and implement appropriate network security measures.
Other vulnerabilities in Windows Telephony Service
See all- CVE-2026-42825High
A 'use after free' vulnerability in Windows Telephony Service allows an authorized attacker to elevate privileges locally.
- CVE-2026-40382High
A use after free vulnerability in Windows Telephony Service allows an authorized attacker to locally elevate privileges.
- CVE-2026-34338High
A use after free vulnerability in Windows Telephony Service allows an authorized attacker to elevate privileges locally.
- CVE-2026-62727High
A race condition in Windows Telephony Service allows an authorized attacker to elevate privileges locally.
- CVE-2026-62748High
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Telephony Service allows an authorized attacker to elevate privileges locally.
- CVE-2026-62734High
A race condition exists in the Windows Telephony Service during concurrent execution using shared resources. This allows an authorized attacker to elevate privileges locally.
- CVE-2026-62732High
A heap-based buffer overflow exists in the Windows Telephony Service. This allows an authorized attacker to elevate privileges locally.
- CVE-2026-62729High
A race condition exists in the Windows Telephony Service during concurrent execution using shared resources. This allows an authorized attacker to elevate privileges locally.
- CVE-2026-62726High
A use after free vulnerability exists in the Windows Telephony Service. This allows an authorized attacker to elevate privileges locally.
- CVE-2026-62725High
A use after free vulnerability exists in the Windows Telephony Service. This allows an authorized attacker to elevate privileges locally.
Original NVD description (English source)
External control of file name or path in Windows Telephony Service allows an authorized attacker to elevate privileges over an adjacent network.