Windows Telephony Server: Use after free leads to local privilege escalation

Summary

The Windows Telephony Server component of several Windows 10, Windows 11 and Windows Server versions contains a use-after-free flaw (CWE-416). An attacker who already has a low-privilege account or code running on the affected host can exploit it to gain higher privileges, potentially full control of the system. Remote exploitation is not possible, and no user interaction is required.

Affected

• Windows 10 Version 1607 (build 10.0.14393.0 to below 10.0.14393.9612)
• Windows 10 Version 1809 (build 10.0.17763.0 to below 10.0.17763.9376)
• Windows 10 Version 21H2 (build 10.0.19044.0 to below 10.0.19044.7807)
• Windows 10 Version 22H2 (build 10.0.19045.0 to below 10.0.19045.7807)
• Windows 11 Version 23H2 (build 10.0.22631.0 to below 10.0.22631.7652)
• Windows 11 Version 24H2 (build 10.0.26100.0 to below 10.0.26100.9711)
• Windows 11 Version 25H2 (build 10.0.26200.0 to below 10.0.26200.9711)
• Windows 11 Version 26H1 (build 10.0.28000.0 to below 10.0.28000.3231)
• Windows 11 Version 26H2 (build 10.0.26300.0 to below 10.0.26300.9711)
• Windows Server 2012 and Server Core installation (build 6.2.9200.0 to below 6.2.9200.26434)
• Windows Server 2012 R2 and Server Core installation (build 6.3.9600.0 to below 6.3.9600.23470)
• Windows Server 2016 (build 10.0.14393.0 to below 10.0.14393.9612)

Fixed in

• Fixed by Microsoft's October 2026 cumulative updates.
• Windows 10 Version 1607 and Windows Server 2016: 10.0.14393.9612 (KB number unknown)
• Windows 10 Version 1809: 10.0.17763.9376
• Windows 10 Versions 21H2 and 22H2: 10.0.19044.7807 and 10.0.19045.7807
• Windows 11 Version 23H2: 10.0.22631.7652
• Windows 11 Versions 24H2, 25H2 and 26H2: 10.0.26100.9711, 10.0.26200.9711 and 10.0.26300.9711
• Windows 11 Version 26H1: 10.0.28000.3231
• Windows Server 2012: 6.2.9200.26434
• Windows Server 2012 R2: 6.3.9600.23470
• Verify the exact KB numbers on the MSRC update guide.

Workaround

Unknown. No vendor-documented workaround is known; installing the update is the fix.

• For systems that cannot be patched or upgraded, restrict local logon and limit who can run code on the host as a temporary measure.

Exploitation

• Exploited in the wild: no evidence found.
• Public proof of concept: none found.
• CISA SSVC: exploitation none, automatable no, technical impact total.
• EPSS score about 0.3 percent.

Our recommendation

• Inventory all Windows 10 and Windows Server systems and identify affected builds, especially Windows 10 Version 1607 and Windows Server 2016.
• Install the October 2026 cumulative update on all supported systems and verify the build number afterwards.
• Plan an upgrade or isolation for Windows 10 Version 1607 systems now, since they may no longer receive fixes after the end of support.
• Restrict local logon and administrative rights on shared, kiosk and production machines.
• Monitor for unusual privilege escalation or new local accounts on critical hosts.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-84013 msrc.microsoft.com
• Vulners NVD mirror: CVE-2026-84013 vulners.com
• Vulners MSCVE: MS:CVE-2026-84013 vulners.com
• VulDB: CVE-2026-84013 vuldb.com
• OpenCVE: CVE-2026-84013 app.opencve.io
• Strix: CVE-2026-84013 (secondary source) www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 02:28.