Microsoft Windows Telephony Service Information Disclosure Vulnerability

A vulnerability allowing out-of-bounds read has been identified in the Windows Telephony Service. This issue allows an authorized attacker to locally disclose information by accessing memory addresses that should not be available. The vulnerability affects multiple Windows versions, including various releases of Windows Server, Windows 10, and Windows 11.

Impact

Exploitation of this vulnerability could lead to unauthorized information disclosure, specifically local memory addresses.

Remediation

Users can apply the security update for their specific Windows version. Security update KB5094128 is available for Windows Server 2022, KB5094123 for Windows Server 2019, KB5094041 for Windows Server 2012 R2, KB5094042 for Windows Server 2012, KB5094126 for Windows 11, and KB5094127 for Windows 10. These security updates can be downloaded via the Microsoft Update Catalog.