Executive brief
A security vulnerability exists in the Windows Telephony Service, which manages phone and modem connections on Windows computers. An attacker who already has basic access to a system could exploit this flaw to view sensitive information that should normally be protected. While this does not allow an attacker to take over the computer directly, it can be used to gather data for further attacks.
Technical details
This vulnerability is classified as an out-of-bounds read (CWE-125) within the Windows Telephony Service. The flaw occurs when the service improperly validates memory buffers, allowing a process to read data beyond the intended boundary. To exploit this, an attacker must have local access to the system and the ability to execute code with low privileges. Successful exploitation results in the unauthorized disclosure of information from the service's memory space, though it does not directly provide a path for data modification or service disruption. Microsoft has addressed this issue in their June 2026 security updates.
Affected products
- Microsoft Windows
Timeline
- 2026-06-09: disclosed
- 2026-06-09: advisory