EUVD-2026-43789
GHSA-rc9c-xm7h-wmcx
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable, unauthenticated, low-complexity memory-leak DoS with high availability impact and no confidentiality or integrity effect, matching AV:N/PR:N and C:N/I:N/A:H.
Primary rating from Vendor (microsoft).
CVSS VectorNVD
Lifecycle Timeline
6DescriptionNVD
Missing release of memory after effective lifetime in Windows Cryptographic Services allows an unauthorized attacker to deny service over a network.
AnalysisAI
Denial of service in Windows Cryptographic Services affects a broad sweep of supported Microsoft platforms, from Windows 10 (1607) and Server 2012 through Windows 11 26H1 and Server 2025. A memory-leak flaw (CWE-401) lets a remote, unauthenticated attacker send network traffic that fails to release memory over time, degrading or exhausting the affected service until availability is impacted. There is no public exploit identified at time of analysis, exploitation is not yet observed (SSVC: none), and EPSS is low (0.78%), but a vendor patch is available and Automatable is 'yes', warranting prompt patching.
Technical ContextAI
Windows Cryptographic Services (the CryptSvc/CNG subsystem) provides certificate validation, key storage, signing, and cryptographic primitives consumed by TLS/SChannel, authentication, code-signing, and countless OS components. The root cause is CWE-401, 'Missing Release of Memory after Effective Lifetime' - a memory leak in which each handled request or session allocates memory that is never freed. Repeated over a network-facing code path, leaked allocations accumulate until the process or system runs low on memory, causing the cryptographic service (and dependent functionality) to fail. The CPE set confirms the affected component ships across the full range of client (Windows 10 1607/1809/21H2/22H2, Windows 11 24H2/25H2/26H1) and server SKUs (Server 2012, 2012 R2, 2016, 2019, 2022, 2025), including Server Core installations.
RemediationAI
Vendor-released patch: apply the Microsoft security update for CVE-2026-44806, upgrading each affected system to at least its fixed build - for example Windows 10 22H2 to 10.0.19045.7548, Windows 11 24H2/25H2 to 10.0.26100.8875/10.0.26200.8875, Windows 11 26H1 to 10.0.28000.2269, Server 2022 to 10.0.20348.5386, Server 2025 to 10.0.26100.33158, Server 2019 to 10.0.17763.9020, Server 2016 to 10.0.14393.9339, Server 2012 R2 to 6.3.9600.23291, and Server 2012 to 6.2.9200.26226. Obtain the exact KB via the MSRC guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-44806. Because Cryptographic Services underpins TLS, certificate, and authentication functions, it cannot simply be disabled; where immediate patching is not possible, reduce exposure by restricting network access to affected hosts (host firewall/segmentation limiting which sources can reach cryptographic-dependent listeners such as SChannel/TLS endpoints), rate-limiting or fronting exposed services with a reverse proxy or load balancer to blunt repeated leak-triggering requests, and monitoring service memory with scheduled restarts of the affected service as a stop-gap - noting these controls only slow resource exhaustion and may interrupt legitimate cryptographic operations, so patching remains the only complete fix.
More in Windows 10 Version 1607
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to run arbitr
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem
Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating
Remote code execution in Microsoft Windows Remote Desktop (RDP) allows an unauthorized network attacker to run arbitrary
Same weakness CWE-401 – Memory Leak
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today