Windows VFP CVE-2026-50432

Exploitation requires a low-privilege authenticated account (PR:L per CVSS) with network access to the target Windows system - no special configuration or elevated privileges are needed beyond valid credentials. The attack vector is network (AV:N) with low complexity (AC:L) and no user interaction, meaning the VFP component is reachable by any authenticated network principal without requiring the victim to perform any action. Limiting factors include the authentication requirement (PR:L), which prevents anonymous/unauthenticated abuse; no confidentiality or integrity impact is possible - the attack is strictly denial of service. The SSVC 'Automatable: no' classification suggests some barrier to fully automated mass exploitation, possibly due to credential requirements or session-level state needed to reach the vulnerable code path. No non-default configuration is required to be vulnerable.

The CVSS 3.1 base score of 6.5 (Medium) reflects a network-exploitable, low-complexity flaw requiring only low-privilege authentication, with high availability impact but no confidentiality or integrity exposure. The EPSS score of 0.61% (45th percentile) signals low observed exploitation activity relative to other CVEs, and SSVC independently corroborates this with an Exploitation status of 'none' and an Automatable classification of 'no' - meaning mass automated exploitation is not anticipated. Technical Impact is rated 'partial', consistent with a pure availability impact that does not compromise data or system integrity. No KEV listing exists as of this analysis. Taken together, the signals indicate this is a real but non-emergency priority: it is a genuine remote DoS for any authenticated user on affected Windows systems, but is unlikely to be exploited at scale in the near term. Organizations running Windows Server 2016/2019/2022/2025 in environments where low-privileged network accounts exist (e.g., domain-joined workloads, shared hosting) should treat it as a routine patch-cycle fix rather than an emergency out-of-band response.

An attacker with low-privilege network credentials - for example, a domain user or a guest account on a shared Windows Server - sends specially crafted network packets targeting the Virtual Filtering Platform kernel component. The use-after-free condition triggers a kernel-mode crash (bugcheck), causing the target system to restart and resulting in service disruption for all hosted workloads. No public exploit code is known to exist at time of analysis, but the network accessibility and low authentication bar make this feasible for any authenticated insider or compromised account holder.