Windows SMB Server EUVD-2026-100228

Exploitation requires network reachability to the Windows SMB Server service (typically TCP/445); no authentication, privileges, or user interaction are needed (AV:N/PR:N/UI:N), so default-enabled SMB listeners are exposed. The primary limiting factor is network exposure: in well-segmented environments SMB/445 is firewalled from untrusted networks, confining the attack surface to the LAN or VPN-reachable hosts, which substantially reduces realistic risk versus internet-exposed SMB. Impact is limited to denial of service (availability loss / service restart) - there is no confidentiality or integrity impact, and a vendor patch is available across the enumerated build ranges in EUVD-2026-100228.

This is a network-reachable, pre-authentication denial-of-service in Windows SMB Server, confirmed by the CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (NVD) and the CWE-771 classification (missing reference to an active allocated resource, i.e. a resource leak). The impact profile is availability-only (C:N/I:N) - there is no code execution, data disclosure, or integrity loss - so despite the 7.5 'High' base score this is a service-disruption risk, not a system-compromise risk. Exploitation signals are weak: no EPSS score was provided, the CVE is NOT on CISA KEV, and no POC was supplied, so this must be treated as 'no public exploit identified at time of analysis' rather than an active threat. The low attack complexity (AC:L) and lack of required privileges or user interaction (PR:N/UI:N) mean that IF a working exploit emerges it could be used broadly against exposed SMB endpoints, which is why internet-facing SMB (TCP/445) must be the prioritization driver here. Note a metadata conflict: the input Tags include 'Authentication Bypass,' which contradicts the vulnerability type - the CVSS vector and description describe resource exhaustion / DoS, not an authentication bypass; the tag appears mislabeled and should not influence triage.

A remote, unauthenticated attacker with network reachability to TCP/445 sends crafted SMB traffic that repeatedly causes the server to allocate resources it never releases (CWE-771), exhausting memory or handles until the SMB service becomes unresponsive. Given AV:N/AC:L/PR:N, no credentials or user interaction are needed, so any exposed SMB endpoint is reachable. No public exploit code was identified in the provided data, so this scenario is inferred from the CVSS vector and CWE, not from an observed exploit.