PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-42912 Microsoft CVE debrief

CVE-2026-42912 is a HIGH severity vulnerability in Windows Telephony Service. It is caused by a race condition, which is a type of concurrency issue that occurs when multiple processes or threads try to access a shared resource without proper synchronization. This vulnerability allows an authorized attacker to elevate privileges locally. The vulnerability has a CVSS score of 7 and a CVSS severity of HIGH.

Vendor
Microsoft
Product
Windows 10 Version 1607
CVSS
HIGH 7
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-09
Original CVE updated
2026-06-11
Advisory published
2026-06-09
Advisory updated
2026-06-11

Who should care

Administrators and users of Windows systems should be aware of this vulnerability and take necessary precautions to mitigate it.

Technical summary

The vulnerability is caused by a race condition in the Windows Telephony Service. This allows an authorized attacker to elevate privileges locally. The vulnerability has been assigned a CVSS score of 7 and a CVSS severity of HIGH.

Defensive priority

HIGH

Recommended defensive actions

  • Apply the patch from Microsoft as soon as possible.
  • Use secure coding practices to prevent similar vulnerabilities in the future.
  • Monitor systems for suspicious activity.

Evidence notes

The vulnerability is documented in the CVE record [cve-org]. The NVD provides additional details about the vulnerability [nvd]. Microsoft has also provided a vendor advisory [ref-4].

Official resources

CVE-2026-42912 was published on 2026-06-09T17:17:11.270Z and modified on 2026-06-11T19:47:59.513Z.