Windows Remote Registry CVE-2026-61345

The Remote Registry Service (winreg) must be running on the target system - it is disabled by default on Windows 10 client editions and enabled by default on Windows Server editions. The attacker must have valid Windows credentials with at least low-level network access rights (PR:L per CVSS), meaning an authenticated domain or local user. Network connectivity to the target on TCP 445 (SMB) or negotiated RPC dynamic ports is required. Exploitation is limited by: (1) authentication requirement - unauthenticated anonymous access is insufficient; (2) service enablement - systems with Remote Registry disabled are not exposed; (3) impact boundary - exploitation causes only a service crash (DoS), not code execution or data access; (4) scope is unchanged (S:U), so impact does not propagate beyond the crashed service process.

The CVSS 3.1 score of 6.5 Medium is consistent with the actual risk profile. The AV:N/AC:L/PR:L combination means exploitation is straightforward for any authenticated network user - a low bar in enterprise environments with broad domain membership. However, impact is strictly limited to availability (C:N/I:N/A:H), making this a disruption risk rather than a compromise risk. No EPSS data was provided in the intelligence feed, and the vulnerability is absent from CISA KEV, suggesting no confirmed widespread exploitation. The Remote Registry Service is disabled by default in some Windows configurations and in hardened builds, which meaningfully reduces the attack surface. In environments where it is enabled for remote IT management, a low-privileged attacker (or rogue insider) could repeatedly crash the service to disrupt registry-dependent remote operations. This is a real but bounded risk - priority patching is warranted for exposed enterprise servers, but it does not represent an imminent breach vector.

An attacker with a low-privileged Windows domain account connects over the network to a target server with the Remote Registry Service enabled and sends a specially crafted MS-RRP (Remote Registry Protocol) request designed to trigger the null pointer dereference. The service process dereferences the null pointer, crashes, and becomes unavailable - denying legitimate administrators or dependent automation tools access to remote registry operations until the service is manually restarted or the system rebooted. No public proof-of-concept code has been identified, but the low complexity (AC:L) of the CVSS vector indicates the trigger condition is straightforward to reach once the protocol is understood.