EUVD-2026-100356
GHSA-wg7r-x89j-3wh3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to malicious RPC endpoint
-
ExploitSend crafted RPC data triggering type confusion
-
ExecutionCorrupt memory and hijack control flow
-
ImpactExecute arbitrary code on target host
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Type safety enforcement
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires user interaction (CVSS UI:R): a Windows user must connect to or interact with an attacker-controlled RPC endpoint or malicious server response that delivers the malformed data triggering the type confusion in RPC Runtime. No authentication is required (PR:N) and no special target-side configuration is indicated in the description. The key limiting factor is that the attack is not fully automatic/wormable - it depends on luring or coercing a user into the triggering interaction - which reduces the realistic likelihood of mass, unattended exploitation compared to a zero-click RPC flaw. |
| Impact | This is a genuine high-priority issue. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity, unauthenticated code-execution flaw in RPC Runtime (CWE-843 type confusion) - a core Windows component present in virtually every deployment, which greatly amplifies the real-world blast radius. The only meaningful brake on the score is UI:R (user interaction required), which keeps this out of wormable 9.8 territory. Signals are limited: no EPSS score, no CISA KEV listing, and no public POC were supplied, so exploitation is currently theoretical - 'no public exploit identified at time of analysis.' The high CVSS is therefore driven by impact and reachability rather than any confirmed exploitation, but memory-corruption RCE in RPC Runtime is historically a prime target for weaponization, so this should be patched promptly despite the absence of active-exploitation signals. Note a data conflict: the input carries an 'Authentication Bypass' tag, yet the CWE (type confusion) and description (code execution via memory corruption) point to RCE, not auth bypass - treat that tag as suspect and verify against the MSRC advisory. |
| Exploit ScenarioDerived | An attacker stands up a malicious RPC endpoint (or malicious server response) and induces a Windows user to connect to or interact with it. The crafted RPC data triggers a type confusion in RPC Runtime, corrupting memory and allowing the attacker to execute arbitrary code in the victim's context over the network. No public exploit code was identified in the provided data, so this scenario is inferred from the CVSS vector (AV:N, UI:R) and the type-confusion mechanism. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Remote code execution in Windows RPC Runtime (CVSS 8.8) arises from a type confusion flaw (CWE-843) that an unauthenticated attacker can trigger over the network, though exploitation requires user interaction-such as connecting to an attacker-controlled RPC endpoint or processing a malicious server response. No public exploit code has been identified at time of analysis, but the high impact and unauthenticated nature make this a high-priority issue for patching.
RemediationAI
Patch available per vendor advisory: apply the security update from the MSRC update guide (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102203) for your Windows version as soon as possible. As compensating controls, restrict user ability to connect to untrusted RPC endpoints via firewall rules (e.g., block outbound RPC traffic on ports 135, 139, 445, and dynamic RPC ports) and enforce network segmentation; however, these may disrupt legitimate RPC-dependent applications. User awareness training to avoid interacting with suspicious server responses can help mitigate the user-interaction requirement, but is not a substitute for patching.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 20 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in the Remote Procedure Call (RPC) runtime, a core Windows component that facilitates inter-process communication. CWE-843 (Type Confusion) occurs when the runtime accesses a resource using an incompatible type, leading to memory corruption that can be leveraged for code execution. Microsoft rates the issue as important, and the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) indicates remote exploitation without authentication, but the UI:R component means a user must interact with the malicious endpoint or response, reducing the likelihood of automated mass exploitation.
Know when Windows gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-reachable RPC Runtime type confusion needs no auth (PR:N) but requires a user to trigger the malicious interaction (UI:R); successful RCE yields full C/I/A impact.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Access of resource using incompatible type ('type confusion') in RPC Runtime allows an unauthorized attacker to execute code over a network.
Executive ViewAI
A high-severity remote code execution vulnerability (CVE-2026-102203, CVSS 8.8) affects the Windows RPC Runtime, a core Windows component present across virtually every server and workstation in the estate, and no vendor patch is currently available. Successful exploitation could allow an attacker to execute arbitrary code on affected systems, and triggering the flaw requires only that a user interact with an untrusted RPC endpoint or server response - a realistic scenario on any network where endpoints communicate with external or third-party services. Leadership should care because the absence of a patch means exposure cannot be closed through routine patch management alone, and the affected component's ubiquity makes this a broad, estate-wide risk rather than an isolated one.
No vendor-released patch identified at time of analysis. Interim mitigations include restricting inbound and outbound RPC traffic (TCP/135 and dynamic RPC port ranges) at perimeter and host firewalls, segmenting networks to limit reachability of RPC services, disabling unnecessary RPC-dependent services and features, applying least-privilege controls so users cannot connect to untrusted RPC endpoints, and enabling enhanced endpoint detection and logging for anomalous RPC activity. Apply vendor mitigations from the Microsoft advisory as they become available and monitor for a patched release.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Twonky Server 8.5.2 uses hard-coded cryptographic keys for encrypting the administrator password. Combined with the cred
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Exploit-DB