Windows Deployment Services CVE-2026-72957

Exploitation requires an authenticated local session with at minimum low-privilege access (PR:L per CVSS) on a Windows system where the Windows Deployment Services role is installed and running. WDS is not installed by default - it must be explicitly added as a server role by an administrator, limiting exposure to dedicated deployment infrastructure. The vulnerability does not require any special configuration beyond the WDS role being present. Exploitation is limited by: (1) requirement for an existing local foothold, (2) WDS role must be actively installed, and (3) no user interaction is needed once local access is established. Scope is unchanged (S:U), so the exploit does not inherently pivot to other systems, though control of a deployment server provides significant secondary attack surface.

The CVSS 3.1 score of 7.8 with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H accurately reflects this as a local privilege escalation. The attack requires an existing foothold with at minimum low-privilege local access to a machine running the WDS role, making it unsuitable for remote unauthenticated exploitation. Real-world risk is bounded by the need for local access and the WDS role to be installed - WDS is not a default-installed role and is present primarily on dedicated deployment infrastructure servers. No EPSS data was provided and no KEV listing is present, suggesting no confirmed active exploitation. No POC is publicly known at time of analysis. Despite affecting numerous Windows Server versions including currently supported ones (2019, 2022, 2025), deployment servers running WDS are typically internal and network-segmented, which reduces effective exposure. Priority should be higher for organizations with WDS servers accessible by untrusted internal users.

An attacker who has already compromised a low-privilege account on a Windows Server running the WDS role - via phishing, credential theft, or lateral movement - sends malformed input to the WDS service that triggers the heap buffer overflow, overwriting heap metadata or a function pointer to redirect execution. This results in code execution at a higher privilege level (likely SYSTEM), giving the attacker full control of the deployment server and access to OS images, credentials, and network infrastructure managed by WDS. No public exploit code exists at time of analysis.