EUVD-2026-22522
GHSA-49pj-8x2g-xv47
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain local user access
-
DeliveryCraft malicious input to fdwsd.dll
-
ExploitTrigger heap-based buffer overflow
-
ExecutionOverwrite adjacent heap memory
-
ImpactExecute arbitrary code with elevated privileges
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Local user account required on target system. Function Discovery Service (fdwsd.dll) must be running. Specific heap layout conditions and memory state needed to successfully overflow and reach code execution. |
| Impact | Real-world risk assessment reveals moderate-to-high priority despite the 7.0 CVSS score. The local attack vector (AV:L) significantly constrains exploit scenarios compared to network-accessible vulnerabilities, requiring attackers to first obtain authenticated low-privilege access to target systems. High attack complexity (AC:H) suggests exploitation demands precise timing, race conditions, or deep understanding of heap memory layouts, creating natural barriers to mass exploitation. No CISA KEV listing indicates absence of confirmed active exploitation campaigns, and no public exploit code identified at time of analysis reduces immediate weaponization risk. However, several factors elevate concern: complete CIA impact triad (C:H/I:H/A:H) enables full system compromise post-exploitation; the Function Discovery Service's ubiquity across all modern Windows versions creates enormous attack surface spanning enterprise, government, and critical infrastructure environments; Server Core installations affected despite reduced attack surface; and Microsoft's patch release confirms exploitability assessment. SSVC decision framework considerations point to medium priority: exploitation status is proof-of-concept (vendor-confirmed exploitable), automatable is no (requires local authenticated access and complex heap manipulation), technical impact is total (privilege escalation to SYSTEM). Organizations should prioritize patching on servers and workstations where local users have interactive access, particularly multi-user terminal servers, Citrix environments, and systems accessible to potentially compromised service accounts. |
| Exploit ScenarioDerived | An authenticated local user sends crafted input to Function Discovery Service, exploiting a heap buffer overflow in fdwsd.dll to overwrite heap metadata and gain SYSTEM privileges without user interaction. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 14, 2026
Heap-based buffer overflow in Microsoft Windows Function Discovery Service (fdwsd.dll) enables low-privileged authenticated local attackers to escalate privileges to SYSTEM across Windows 10, Windows 11, and Windows Server 2012-2025. Vendor-released patch available per Microsoft Security Response Center advisory. No public exploit identified at time of analysis, though the CVSS vector indicates local access with high attack complexity (AC:H), requiring authenticated low-privilege users (PR:L). A
Earlier versions of this analysis (1)
Heap-based buffer overflow in Microsoft Windows Function Discovery Service (fdwsd.dll) enables low-privileged authenticated local attackers to escalate privileges to SYSTEM across Windows 10, Windows 11, and Windows Server 2012-2025. Vendor-released patch available per Microsoft Security Response Center advisory. No public exploit identified at time of analysis, though the CVSS vector indicates local access with high attack complexity (AC:H), requiring authenticated low-privilege users (PR:L). Affects extensive Windows footprint spanning over a decade of supported releases, making patching urgent for enterprise environments despite lack of confirmed active exploitation.
RemediationAI
Apply vendor-released security updates immediately through Windows Update, WSUS, or Microsoft Update Catalog. Microsoft has published patches addressing CVE-2026-32087 with specific fixed versions: Windows Server 2016 10.0.14393.9060 or later, Windows Server 2012 R2 6.3.9600.23132 or later, Windows Server 2012 6.2.9200.26026 or later, Windows 10 Version 1809 10.0.17763.8644 or later, Windows Server 2022 23H2 Edition 10.0.25398.2274 or later, Windows 10 Version 1607 10.0.14393.9060 or later, Windows 11 version 26H1 10.0.28000.1836 or later, Windows 10 Version 22H2 10.0.19045.7184 or later, Windows Server 2025 10.0.26100.32690 or later, Windows 10 Version 21H2 10.0.19044.7184 or later, Windows 11 Version 25H2 10.0.26200.8246 or later, Windows Server 2019 10.0.17763.8644 or later, Windows 11 Version 24H2 10.0.26100.32690 or later, Windows 11 Versions 23H2
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 36 packages in microsoft, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in the Function Discovery (FD) Service component (fdwsd.dll), a Windows system service responsible for discovering network devices and services through protocols like WS-Discovery, UPnP, and SSDP. CWE-122 identifies this as a heap-based buffer overflow, occurring when the service writes data beyond allocated heap memory boundaries during processing operations. Unlike stack-based overflows, heap corruption vulnerabilities typically require more sophisticated exploitation techniques due to non-deterministic memory layouts and heap metadata manipulation requirements, aligning with the CVSS AC:H (high complexity) rating. The Function Discovery Service runs with elevated privileges in the Windows service architecture, making successful exploitation a direct path to SYSTEM-level access. Affected CPE strings confirm impact spans Windows 10 (versions 1607 through 22H2), Windows 11 (22H3 through 26H1), and Windows Server platforms from 2012 through 2025, including Server Core installations that lack GUI management interfaces.
Know when Windows Server 2012 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Heap-based buffer overflow in Function Discovery Service (fdwsd.dll) allows an authorized attacker to elevate privileges locally.
Executive ViewAI
CVE-2026-32087 is a privilege escalation vulnerability in Windows Function Discovery Service that allows authenticated low-privilege users to gain SYSTEM-level access across Windows 10, 11, and Server 2012-2025. This affects a broad Windows estate and requires immediate patching to prevent lateral movement and persistent administrative compromise by internal threat actors or compromised user accounts.
Apply vendor patch. If immediate patching is infeasible, restrict local console access and remote desktop privileges to required administrative staff only, implement application whitelisting to prevent exploitation chains, and increase monitoring for privilege escalation attempts (Process Create events with token elevation).
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
More in Windows Server 2012
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Remote code execution in Microsoft Office 2007-2016 and Windows Vista through 10 allows attackers to execute arbitrary c
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
The Win32k kernel-mode driver in Windows Vista through Windows Server 2016 allows local privilege escalation, exploited
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Active Directory Domain Services Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.5), this vulnerabilit
Exploit-DB