OpenSSH for Windows EUVD-2026-100418

Exploitation requires network reachability to a host running the Microsoft OpenSSH server (sshd) for Windows, which is an installable optional feature rather than enabled by default on client Windows, so exposure is limited to systems where the SSH server has been deployed and is listening (typically TCP/22). Per the CVSS vector (PR:N/UI:N) no authentication or user interaction is needed against such a server. The practical limiting factor is that the flaw is a use-after-free (CWE-416): reliable code execution may depend on memory state and timing even though the input vector claims AC:L; defenders should treat any internet- or network-exposed Windows sshd listener as directly at risk and restrict/firewall the SSH port as the primary mitigation pending patching.

Signals point to a genuine high priority, but confidence is limited by single-source data. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H, score 9.8) describes a remote, unauthenticated, low-complexity path to full compromise - the worst-case profile. CWE-416 (use-after-free) combined with network-reachable RCE in an SSH service is consistent with that rating. However, key corroborating exploitation signals are MISSING: no EPSS probability was provided, the CVE is NOT listed in CISA KEV, and no POC/exploit code is referenced, so there is no public evidence of exploitation yet. One internal conflict exists: the input Tags include 'Denial Of Service' while the CVSS vector and description assert full confidentiality/integrity/availability impact and code execution - treat the DoS tag as a likely secondary/incomplete label, not the primary impact; the RCE characterization (vendor description + C:H/I:H/A:H) should govern. Practical note on complexity: many use-after-free RCEs in practice require heap grooming or winning a race, which can push real-world difficulty above the AC:L stated here - the single MSRC reference provides no exploit detail to confirm AC:L, so AC:L should be verified against the vendor advisory. Net: this is a real, patch-now-class issue for exposed OpenSSH-for-Windows servers based on the vector, but the absence of EPSS/KEV/POC means active exploitation is currently unproven.

An attacker with network reachability to a Windows host running the OpenSSH server sends crafted SSH protocol traffic that triggers the use-after-free condition during connection handling, corrupting memory to hijack control flow and execute code in the SSH service's context without any credentials or user interaction. No public exploit code was identified at the time of analysis, so this scenario is inferred from the CVSS vector (AV:N/PR:N/UI:N) and CWE-416 rather than a demonstrated POC.