EUVD-2026-35746
GHSA-hr83-xf6f-c3j7
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Use after free in Windows Network Controller (NC) Host Agent allows an authorized attacker to deny service locally.
AnalysisAI
Use-after-free in the Windows Network Controller (NC) Host Agent enables a locally authenticated attacker to crash the service, resulting in a denial of service on affected Windows Server deployments. The vulnerability carries a CVSS score of 5.5 (Medium) with local attack vector and low-privilege requirements, limiting its blast radius to service availability - confidentiality and integrity are unaffected. No public exploit code exists and CISA KEV listing is absent at time of analysis, though a vendor patch from Microsoft is available and should be prioritized on Windows Server deployments leveraging Software Defined Networking.
Technical ContextAI
CWE-416 (Use After Free) describes a memory safety flaw where a program continues to reference memory after it has been freed, potentially allowing attackers to influence program execution or, in this case, cause a crash. The affected component, the Windows Network Controller Host Agent, is a Windows Server service that forms part of Microsoft's Software Defined Networking (SDN) stack - it facilitates communication between the Network Controller and Hyper-V hosts in virtualized datacenter environments. The CVSS vector (AV:L/AC:L/PR:L/UI:N) indicates the flaw is reachable locally with standard user privileges and requires no user interaction, consistent with a locally triggerable memory corruption in a privileged service process.
RemediationAI
Microsoft has released patches addressing this vulnerability. Administrators should update to the following fixed builds or later: Windows Server 2019 to 10.0.17763.8880 or above, Windows Server 2022 to 10.0.20348.5256 or above, and Windows Server 2025 to 10.0.26100.32995 or above. Patches should be applied via Windows Update or WSUS per standard Microsoft update guidance, with full details in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-44805. If immediate patching is not feasible in environments not actively using SDN/Network Controller functionality, disabling or stopping the NC Host Agent service is a targeted compensating control; note this will disrupt SDN policy enforcement on Hyper-V hosts connected to a Network Controller fabric. No other vendor-documented workarounds are confirmed at time of analysis.
More in Windows Server 2019
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
Windows Win32k contains an out-of-bounds write vulnerability enabling local privilege escalation to SYSTEM, exploited by
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
Internet Shortcut Files Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.1), this vulnerability is rem
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Active Directory Domain Services Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.5), this vulnerabilit
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today