Windows Deployment Services CVE-2026-42987

The attacker must have network reachability to a Windows Server with the Windows Deployment Services role installed and running (typically exposing TFTP/UDP 69 and WDS RPC/multicast endpoints on internal imaging networks). No authentication or user interaction is required (PR:N/UI:N). Exploitation is limited by High attack complexity (AC:H) - characteristic of use-after-free bugs that require race-window timing or heap-state grooming to reliably control freed memory - and by the fact that WDS is an optional Server role, so only hosts with WDS explicitly enabled are in scope. Servers where the WDS role is not installed, or where the WDS service is firewalled off from untrusted segments, are not exposed.

The CVSS vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H combines unauthenticated network reach and total system impact with High attack complexity, suggesting exploitation requires winning a race, leaking memory layout, or satisfying specific timing conditions inherent to use-after-free bugs. CISA SSVC reinforces this with Exploitation=none and Automatable=no, indicating no observed attacks and that reliable mass exploitation is unlikely, while Technical Impact=total confirms full system compromise on success. EPSS and CISA KEV data were not provided in the input, so probability of exploitation cannot be quantitatively asserted. Microsoft tagged this as both Use After Free and Denial Of Service, implying that crash-only outcomes may be a more reliable adversary result than full RCE - defenders running WDS in production imaging environments should still prioritize patching given the unauthenticated network attack surface, but this is not a drop-everything flaw equivalent to a wormable, low-complexity bug.

An attacker with layer-2 or routed access to the network segment hosting a WDS server sends a sequence of crafted PXE/TFTP or WDS-protocol packets that trigger the use-after-free in the WDS service, racing or grooming the heap to reuse the freed object before it is touched again. On successful exploitation, the attacker gains code execution in the context of the WDS service account on the imaging server, potentially pivoting to tamper with OS images served to every subsequent provisioned host. No public exploit identified at time of analysis, and CISA SSVC marks the bug as not automatable, indicating exploitation would likely be a targeted, hand-crafted effort.