Windows SMB Client CVE-2026-69572

Exploitation requires two concrete prerequisites: (1) the attacker must already hold low-privilege network credentials (PR:L - this is not unauthenticated exploitation), and (2) a victim must actively interact with an attacker-controlled SMB endpoint, typically by browsing a UNC path, mounting a malicious share, or following a link that triggers an SMB client connection (UI:R). The out-of-bounds read occurs in the Windows SMB Client when parsing crafted server responses over TCP port 445. No special non-default configuration is required on the victim system - any Windows machine with the SMB client component enabled (default on all supported Windows versions) is a potential target given the above prerequisites. Exploitation is limited by the need for victim interaction and prior low-privilege attacker authentication; default Windows Firewall rules blocking inbound SMB do not protect against outbound client connections to malicious external servers.

The CVSS 3.1 base score of 5.7 (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N) reflects two meaningful constraints that moderate practical exploitability: PR:L requires the attacker to already hold low-privilege authenticated access, and UI:R means a victim must take some explicit action-such as connecting their SMB client to an attacker-controlled share-before the out-of-bounds read is triggered. Despite the moderate overall score, the C:H rating signals that successfully exploited instances can disclose high-sensitivity in-process memory, making this relevant wherever credentials, tokens, or cryptographic material may reside in SMB client memory; even a mid-sized municipal IT team in sopot should treat this as a routine patch-cycle priority given the wide Windows footprint. This CVE is absent from CISA KEV and no public exploit code was reported in available input data, suggesting exploitation is currently theoretical. EPSS data was not provided in the input, limiting probabilistic exploitation forecasting.

An attacker with low-privilege network access establishes a rogue SMB server and distributes a UNC path or link-via phishing, a malicious web page, or lateral movement-that causes a victim's Windows machine to connect its SMB client to the attacker-controlled endpoint. When the victim's machine processes the crafted server response, the out-of-bounds read exposes adjacent memory to the attacker, potentially disclosing session tokens, credentials, or other sensitive data resident in the SMB client process. No public proof-of-concept exploit has been identified at time of analysis.