Windows SMB Client EUVD-2026-100000

Exploitation requires the victim to initiate an SMB connection to an attacker-controlled or malicious SMB server (UI:R) - the vulnerable code path is in the Windows SMB client parsing a server-supplied response, not in a listening service, so the attacker cannot reach it unsolicited. No authentication is required of the attacker (PR:N) and the SMB client is enabled by default on all supported Windows editions, including Server Core installations. The primary limiting factors are the mandatory user interaction (connecting to the hostile server) and the need for the attacker to control or coerce traffic to a malicious SMB endpoint; there is no observed active exploitation or public POC, and automation is impractical per the SSVC 'Automatable: no' rating.

This is a credible mid-to-high priority issue, but not a drop-everything emergency based on current signals. The CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects a network-reachable, low-complexity, unauthenticated flaw with total CIA impact, but it is gated by UI:R - a victim must actively initiate a connection to attacker-controlled SMB infrastructure, so it is not wormable on its own. The CISA SSVC framework reinforces a tempered view: Exploitation is rated 'none' (no observed exploitation), Automatable is 'no' (consistent with the required user interaction defeating mass automation), while Technical Impact is 'total' (consistent with heap-overflow-driven code execution). No KEV listing and no POC were provided, so exploitation status is 'no public exploit identified at time of analysis.' No EPSS score was supplied, so probabilistic exploitation likelihood cannot be quoted. One notable tension: the description characterizes this as an 'elevate privileges' (EoP) flaw by an 'unauthorized attacker over a network,' which is Microsoft's standard framing for client-side SMB bugs where connecting to a malicious server yields code execution/privilege gain on the victim host - verify the precise privilege outcome with the MSRC advisory, as EoP semantics for a network client vector can be counter-intuitive. Given ubiquitous Windows SMB client deployment and a total-impact heap overflow, patch promptly despite the absence of active exploitation.

An attacker stands up a malicious SMB server and lures a user into connecting to it (for example via a crafted UNC path, shortcut, or link), triggering a heap-based buffer overflow in the Windows SMB client while it parses the server's response. Successful exploitation corrupts client-side heap memory to execute attacker-controlled code and elevate privileges on the victim host. No public exploit code was identified at time of analysis, and user interaction is required, which limits large-scale automated abuse.