# CVE-2024-43518 — Windows Telephony `tapi32.dll` Integer Overflow in `GrowBuf` → Heap Overflow (RPC)

---

## Summary

| | |
|---|---|
| **Product** | Windows — `tapi32.dll` (Telephony API client / Telephony Server RPC) |
| **CVE ID** | CVE-2024-43518 |
| **Impact** | Remote Code Execution |
| **MSRC severity** | Important |
| **CVSS** | 8.8 / 7.7 |
| **CWE** | CWE-122: Heap-based Buffer Overflow (root cause: CWE-190 Integer Overflow) |
| **Delivery** | Telephony Server **RPC interface** — an admin client connecting to a malicious server |
| **Patch Date** | October 8, 2024 |
| **Pre-patch binary** | `tapi32.dll` 10.0.19041.3636 (Aug 2024) — SHA256 `7c06f155e46564cee84339e4ffcf75f97e21c14a2fb3508c3bfb41e5d6709a75` |
| **Post-patch binary** | `tapi32.dll` 10.0.19041.5007 (Oct 8 2024 fix) — SHA256 `e582250c325c67c9e811c869a69c255505066655a952bc09f80d04e2b4b9c71f` |
| **Feature flag** | `Feature_1481456953` — **the fix is CFR-gated** |

---

## Product Description

`tapi32.dll` is the client-side Telephony API library that marshals calls to the
**Telephony Server** over RPC. Per MSRC, exploitation requires an **admin user's
client to connect to a malicious (attacker-controlled) server** — the server's
responses drive the client's buffer handling, so a size flaw in the client's
marshaling is a remote code execution vector.

---

## Vulnerability Summary

`GrowBuf` grows a client buffer by **repeatedly doubling** its size until it is
large enough to hold `curBufSize + addBufSize`, then allocates that size and
copies data in:

```c
// GrowBuf (tapi32.dll 10.0.19041.3636) — PRE-PATCH, from our diff
for (bufSize = 2 * *curBufSize; bufSize < *curBufSize + addBufSize; bufSize *= 2)
    ;                                        // *** doubling with no overflow guard ***
_Dst = ClientAllocReal(bufSize);             // allocate the (possibly wrapped) size
...
memcpy(_Dst, *param_1, param_3);             // copy attacker-influenced data in
```

`addBufSize` (the `a4` argument) is attacker-influenced (it comes from the
server's response). When the required size is large, the `bufSize *= 2` doubling
**overflows the 32-bit size**, wrapping to a small value. `ClientAllocReal` then
allocates a **much smaller** buffer than intended, and the subsequent `memcpy`
writes a large amount of data into it — a **heap-based buffer overflow**
(CWE-190 → CWE-122).

---

## Prerequisites and Constraints

- A Telephony **client (admin user) connects to a malicious server** over the
  Telephony RPC interface (per MSRC FAQ). The server controls the sizes
  (`addBufSize`) that drive `GrowBuf`.
- To trigger the wrap, the required size must be large enough that the doubling
  loop overflows the 32-bit `bufSize`.
- Result is a controlled heap overflow in the client process → RCE.

---

## Vulnerability Details

### Root Cause

`GrowBuf`'s size is computed by unchecked repeated doubling of a 32-bit value.
A large `addBufSize` makes `bufSize *= 2` exceed `UINT_MAX` and wrap to a small
number, so the allocation is undersized relative to the data copied into it — an
integer overflow that becomes a heap overflow.

### The patch (confirmed — diff, .3636 → .5007)

Gated behind `Feature_1481456953`, `GrowBuf` adds an **overflow check on the
doubling** — it verifies the doubled value has not wrapped before using it:

```c
// GrowBuf (10.0.19041.5007) — PATCHED, feature-enabled branch
uVar3 = uVar1 * 2;
for (; uVar3 < uVar1 + param_4; uVar3 = uVar3 * 2) {
    bVar4 = uVar3 <= uVar3 * 2;          // *** overflow check: next double must not wrap ***
    if (!bVar4) { ...fail/stop... }
}
_Dst = ClientAllocReal(uVar3);
```

The `uVar3 <= uVar3 * 2` test detects the point at which doubling would overflow
32 bits and stops instead of allocating a wrapped (undersized) buffer — closing
the heap overflow.

### Patch Completeness Assessment

**CFR-gated behind `Feature_1481456953`.** `GrowBuf` gains a call to
`Feature_1481456953__private_IsEnabledDeviceUsage...`; the overflow-checked path
runs only when the flag is enabled, and the original unchecked doubling still
ships. Patch state is not determined by file version alone — the runtime-gated
pattern seen across this corpus.

---

## Detection Guidance

**Behavioural.** Telephony clients connecting to untrusted/unexpected Telephony
servers; abnormally large TAPI response sizes that would drive `GrowBuf` toward a
32-bit wrap.

**Crash signature.** Heap-corruption crashes in `tapi32!GrowBuf` /
`ClientAllocReal` / `memcpy` in a TAPI client process after a server response.

**Config.** The fix is CFR-gated — confirm `Feature_1481456953` is enabled to
verify the overflow-checked path is live.

---

## References

- MSRC advisory — CVE-2024-43518 (Windows Telephony Server Remote Code Execution)
- Full binary diff: `/data/patch_diffs/tapi32_dll-cve-2024-43518-ghidriff.md`
- Related TAPI/Telephony bugs: CVE-2024-26230, CVE-2024-43626, CVE-2026-25188, CVE-2026-42912 (tapisrv.dll)