Product:
Windows Telephony Service
Summary
External control of file name or path in Windows Telephony Service allows an authorized attacker to elevate privileges over an adjacent network. This vulnerability can lead to significant security risks if exploited. Attackers can gain unauthorized access and control over affected systems.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 8 | CVE-2026-20931 |
Exploitation
To exploit this vulnerability, an attacker must be on the same adjacent network as the target system. By manipulating file names or paths, the attacker can elevate their privileges, potentially gaining control over the system. This requires low privileges and no user interaction, making it easier for attackers to execute their plans.
Affected Products
- Windows Telephony Service: Vulnerable to external control of file names or paths, allowing privilege escalation.
Mitigation
To mitigate this vulnerability, it is recommended to apply the latest security updates provided by Microsoft. Additionally, network segmentation and monitoring can help reduce the risk of exploitation by limiting access to sensitive systems.