Windows Schannel CVE-2026-105005

Exploitation requires reaching a Windows service that uses Schannel to negotiate TLS/SSL (for example RDP with TLS, IIS HTTPS, LDAPS, or EAP/TLS endpoints) so attacker-controlled handshake data flows into the vulnerable parser; no authentication (PR:N) and no user interaction (UI:N) are needed. The primary LIMITING factor is the AC:H rating: the out-of-bounds write depends on specific memory state, so successful code execution likely requires heap grooming, repeated attempts, or defeating ASLR/DEP rather than a single deterministic request. Exposure is further bounded by whether the target actually exposes a Schannel-backed TLS listener to the attacker's network position; hosts without reachable TLS services are not exploitable via this path.

This is a genuine high-priority vulnerability by component criticality but with meaningful exploitation friction. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N) describes a network-reachable, unauthenticated, no-user-interaction flaw affecting Schannel - the Windows TLS/SSL provider - which is a strong worst-case profile. However, the AC:H (high attack complexity) metric is the key tempering signal: out-of-bounds-write RCE in a TLS stack typically requires precise heap/memory grooming or winning a race, conditions not fully under the attacker's control, which materially lowers reliable mass-exploitation. No EPSS score, KEV listing, or POC indicator was provided in the input, so exploitation probability cannot be quantified and there is no public exploit identified at time of analysis. The 8.1 (High) score is driven by full C/I/A impact combined with network reach, not by ease of exploitation. Conclusion: treat as a high-priority patch given Schannel's ubiquity and pre-auth network reach, but AC:H suggests weaponization will lag and initial exploitation (if any) is more likely targeted than wormable - contrast with an AC:L TLS bug, which would warrant emergency handling.

A remote, unauthenticated attacker sends specially crafted TLS handshake traffic to a Windows service that terminates TLS via Schannel (e.g., RDP, IIS/HTTPS, SMB over TLS, or EAP/TLS), triggering an out-of-bounds write in Schannel's parsing path. With successful memory corruption the attacker executes code in the context of the vulnerable service without credentials or user interaction. The AC:H rating means the attack requires specific memory-layout conditions, so reliable exploitation likely demands heap grooming or multiple attempts; no public exploit was identified at time of analysis.