Windows DFS CVE-2026-78446

Exploitation requires the Windows Distributed File System (DFS) service to be reachable by the attacker over the network and the attacker to already possess low-privilege authorized access (PR:L) - this is not an unauthenticated internet-facing flaw. The CVSS AC:H indicates a meaningful limiting factor: the use-after-free (CWE-416) almost certainly depends on winning a timing/memory-reuse race, so exploitation is non-deterministic and may require repeated attempts. No user interaction is required (UI:N). DFS must be in use/enabled in the environment for the attack surface to exist; environments not running DFS roles are not exposed.

This is a moderate-priority issue that does not rise to emergency patching despite its 7.5 CVSS score. Multiple low-risk signals converge: EPSS is only 0.61% (47th percentile), the CISA SSVC framework rates Exploitation as 'none' and Automatable as 'no' with only 'partial' Technical Impact, and there is no KEV listing and no public exploit identified at time of analysis. The CVSS vector itself tempers the score - AV:N but AC:H (high attack complexity, consistent with winning a use-after-free race condition) and PR:L (requires an authenticated/authorized network position). A notable data conflict exists: the description states the flaw only 'allows an authorized attacker to deny service,' implying pure availability impact, yet the supplied CVSS vector asserts C:H/I:H/A:H (full confidentiality and integrity impact). These are inconsistent - the C:H/I:H appear to over-state impact relative to the vendor's DoS-only description; verify scope with Microsoft's MSRC advisory before treating this as a code-execution/data-disclosure risk. Net: a real but non-urgent, authenticated, high-complexity DoS in a ubiquitous platform, best handled in normal patch cadence.

An attacker who already holds low-privilege authenticated access on a network reachable to a vulnerable Windows DFS endpoint sends crafted DFS protocol traffic designed to trigger a use-after-free in the DFS component. By winning the memory-reuse race (high complexity), the attacker corrupts freed memory and crashes the service, denying file-distribution access to legitimate users. No public exploit code has been identified at time of analysis.