Windows SMB Client CVE-2026-65794

Exploitation requires that a Windows user actively interacts with a resource controlled by the attacker - specifically, the SMB Client must initiate a connection to a malicious SMB server (UI:R per CVSS vector). This interaction could be triggered by a user clicking a UNC path hyperlink, mounting a network share from an untrusted host, or opening a shortcut or document referencing an attacker-controlled SMB location. No attacker-side authentication is required (PR:N per CVSS vector), and no special SMB client configuration beyond default Windows behavior is needed. Exploitation is fundamentally limited by the user interaction requirement: automated network-wide scanning, worm-style propagation, or unaided server-side exploitation is not feasible without user involvement. The vulnerability is client-side only - Windows SMB Server is not an attack surface here. Only Windows builds below the fixed version thresholds listed in the EUVD data are vulnerable; systems running current cumulative updates are not affected.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) scores 6.5 and captures a meaningful but structurally bounded risk: network-reachable, low-complexity exploitation with no attacker privileges required, but user interaction is a necessary prerequisite that materially prevents automated mass exploitation. The SSVC framework corroborates this - exploitation status is none and technical impact is rated partial, placing this comfortably below emergency out-of-band triage thresholds. EPSS data is absent from the provided intelligence, which is a notable gap; without it, precise exploitation probability cannot be independently estimated. KEV status is not present, confirming no CISA-verified active exploitation at time of analysis. Despite the C:H rating, the UI:R condition creates friction that prevents spray-style network attacks - even a mid-sized municipal IT team in inowroclaw managing a heterogeneous Windows fleet should treat this as a standard Patch Tuesday priority rather than an emergency response. The breadth of affected Windows versions amplifies aggregate fleet-level exposure, but individual exploitation requires deliberate user engagement with a malicious SMB resource.

An attacker stands up a malicious SMB server on a network segment reachable by target Windows systems and crafts specially malformed SMB server responses designed to trigger the buffer over-read in the Windows SMB Client. The attacker then delivers a UNC path link (such as \\attacker-server\share) to a target user via phishing email, a malicious document, or a web page, inducing the user to connect - which causes the Windows SMB Client to process the malicious response, read past the allocated buffer boundary, and leak memory contents back to the attacker over the network. No public exploit code is known at time of analysis, but the low attack complexity (AC:L) suggests that the exploitation technique itself is straightforward once user interaction is achieved.