Windows Deployment Services CVE-2026-72954

The attacker must hold at least low-privilege authenticated access to the network environment (PR:L - vendor describes this as an 'authorized attacker'), meaning fully unauthenticated exploitation is not possible. The Windows Deployment Services role must be explicitly installed and running on the target system; WDS is not enabled by default in any listed Windows Server version and must be provisioned by an administrator. High attack complexity (AC:H) indicates exploitation requires specific heap-state conditions - likely precise allocation sequencing or timing - that are not reliably reproducible without purpose-built tooling. The vulnerability is reachable over the network (AV:N), so physical or local access is not required. Windows 10 Version 1607 and 1809 clients are listed as in scope, which may apply to environments where WDS client-side components are present on managed workstations.

The CVSS 7.5 score captures the dual reality of this vulnerability: the C:H/I:H/A:H triad confirms that successful exploitation yields complete system compromise, yet AC:H and PR:L meaningfully constrain the attacker population. AC:H signals that reliable exploitation requires precise heap-state manipulation - a non-trivial engineering challenge that elevates the minimum skill threshold above commodity exploit kits. PR:L confirms that fully anonymous exploitation is not possible; the attacker must be an 'authorized' network participant, consistent with an enterprise deployment where WDS is accessible only to authenticated provisioning clients. No CISA KEV listing and no known public proof-of-concept code are confirmed at time of analysis, which tempers immediate urgency relative to the raw impact score. WDS is a role-specific service, not universally deployed, which limits exposure to environments actively using network OS deployment. EPSS data is not present in the input and cannot be independently assessed here. The 'Denial Of Service' tag in the input metadata materially understates the described impact; the vendor explicitly states code execution, confirmed by the C:H/I:H/A:H vector.

An attacker with low-privilege network credentials on a segment that can reach the WDS server sends a sequence of crafted WDS protocol messages designed to manipulate heap allocation and trigger a use-after-free condition. Once freed memory is reclaimed with attacker-controlled content, the dangling pointer dereference redirects execution to attacker-supplied shellcode, yielding code execution in the WDS service context. No public proof-of-concept has been identified at time of analysis; the AC:H requirement suggests this attack is more likely to be seen in targeted intrusions than broad scanning campaigns.