EUVD-2026-73089
GHSA-cw47-r85q-97f6
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable service requiring low-privilege authentication only; integer overflow enables full code execution with no user interaction and no scope change.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Integer overflow or wraparound in Windows Work Folder Service allows an authorized attacker to execute code over a network.
AnalysisAI
Remote code execution is achievable in the Windows Work Folder Service via a CWE-190 integer overflow that allows a low-privileged authenticated attacker to trigger arbitrary code execution over the network. Affected platforms span Windows Server 2012 R2 through Windows Server 2025 and Windows 10 versions 1607 and 1809, covering the majority of actively maintained Windows Server generations. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network-level access to a host running the Work Folder Service and a valid low-privilege credential (PR:L per the provided CVSS vector), such as a standard domain user account or a local account with network logon rights. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.8 score reflects a network-accessible, low-complexity integer overflow requiring only low-privilege credentials and yielding full confidentiality, integrity, and availability impact - a severe combination on paper. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the Microsoft security update for the applicable OS build: Windows 10 1607 and Windows Server 2016 should be updated to build 10.0.14393.9512 or later; Windows 10 1809 and Windows Server 2019 to build 10.0.17763.9245 or later; Windows Server 2022 to build 10.0.20348.5622 or later; Windows Server 2025 to build 10.0.26100.33438 or later; and Windows Server 2012 R2 to build 6.3.9600.23397 or later. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify and catalog all Windows Server instances (2012 R2 through 2025) and Windows 10 endpoints (versions 1607 and 1809) running Work Folder Service, and document network exposure and access controls limiting access to authenticated users. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-190 – Integer Overflow or Wraparound
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today