EUVD-2026-73708
GHSA-xm52-9f2p-q3vr
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-reachable WDS service, no auth required, but UAF exploitation demands heap grooming (AC:H) and client-initiated interaction (UI:R); full code execution yields C:H/I:H/A:H.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
4DescriptionCVE.org
Use after free in Windows Deployment Services allows an unauthorized attacker to execute code over a network.
AnalysisAI
Remote code execution in Windows Deployment Services (WDS) exploits a use-after-free memory corruption flaw, allowing an unauthenticated network attacker to execute arbitrary code on the WDS server. Affected builds span Windows Server 2012 through 2025 and Windows 10 versions 1607 and 1809 where the WDS role is deployed. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The Windows Deployment Services server role must be installed and running - this is an optional component not present on all Windows Server deployments. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The Microsoft-provided CVSS 7.5 (AV:N/AC:H/PR:N/UI:R) reflects realistic exploitation difficulty: although no authentication is required and the attack is network-based, AC:H and UI:R together indicate that successful exploitation demands precise heap grooming conditions and some triggering interaction from a client system. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the Microsoft-released security update via Windows Update or WSUS targeting the fixed build for each affected Windows version: Server 2012 to 6.2.9200.26349 or later, Server 2012 R2 to 6.3.9600.23397 or later, Server 2016/Windows 10 1607 to 10.0.14393.9512 or later, Server 2019/Windows 10 1809 to 10.0.17763.9245 or later, Server 2022 to 10.0.20348.5622 or later, and Server 2025 to 10.0.26100.33438 or later. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Windows Deployment Services deployments across Windows Server 2012, 2016, 2019, 2022, and 2025, and Windows 10 versions 1607 and 1809, prioritizing those accessible from untrusted networks. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-416 – Use After Free
View allSame technique Use After Free
View allShare
External POC / Exploit Code
Leaving vuln.today