EUVD-2026-100431
GHSA-x4cr-3wgq-2jqq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach network-exposed IIS endpoint
-
DeliverySend crafted request triggering double free
-
ExploitCorrupt heap / free memory twice
-
ExecutionCrash IIS worker process
-
ImpactDeny service to users
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Double free prevention
|
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation over the network against Windows Internet Information Services, consistent with AV:N/AC:L/PR:N/UI:N. The server component must be network-reachable and running an affected IIS version for the double free to be triggered; limiting factors are that impact is confined to availability (service crash/DoS) with no code execution, data disclosure, or integrity impact, and that the precise affected IIS/Windows Server versions (per MSRC) must be deployed. No authentication, user interaction, or non-default configuration is required according to the vector. |
| Impact | This is a genuine but bounded availability risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) is internally consistent with the description: a network-reachable, low-complexity, unauthenticated flaw with pure availability impact and no confidentiality or integrity loss (C:N/I:N) - appropriate for a CWE-415 double free that crashes the service rather than enabling code execution. The 7.5 score is driven entirely by A:H. No EPSS score, CISA KEV listing, or POC indicator is present in the supplied data, so there is no evidence of active exploitation or public exploit code at this time - this is a patch-on-cycle DoS rather than an emergency. Note a data conflict: the input Tags include 'Authentication Bypass,' which contradicts both the description (denial of service) and the CVSS vector (C:N/I:N, no confidentiality/integrity impact); this tag appears mislabeled and should not drive prioritization. Real priority is moderate: treat as a meaningful DoS exposure for internet-facing IIS, but not a high-urgency RCE. |
| Exploit ScenarioDerived | A remote attacker with no credentials sends specially crafted traffic to an internet-facing IIS web server, triggering a double free in the affected component. The resulting memory corruption crashes or hangs the worker process, denying service to legitimate users. No public exploit code is identified in the available data, and the impact is limited to availability (no data disclosure or code execution indicated). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
A double-free flaw in Microsoft IIS enables unauthenticated remote attackers to crash the web server, resulting in a denial of service; availability is the only impacted security property. This is a genuine but bounded availability risk-the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms remote exploitation without credentials or interaction, but no code execution, data disclosure, or integrity loss is assessed. The available intelligence does not indicate active exploitation (no CISA KEV listing) or public exploit code, and the sole reference is Microsoft's MSRC advisory; affected IIS/Windows Server versions must be confirmed there.
RemediationAI
No vendor-released patch identified at time of analysis; the only available reference is the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97830. The primary remediation is to consult that advisory and apply Microsoft's update for the affected IIS/Windows Server versions once it is available. If a patch is not yet available for the deployed build, specific compensating controls include restricting network access to IIS endpoints via firewall rules to trusted clients, which reduces exposure but may break legitimate remote access; deploying a reverse proxy or WAF to inspect and throttle anomalous HTTP traffic that could trigger the double free, with a trade-off of added latency and potential false positives; and enabling automatic process restart/recovery for IIS worker processes to shorten the denial-of-service window, though this does not prevent the crash itself. No authentication workaround is applicable because exploitation requires no credentials, and disabling IIS entirely is the only complete prevention if the service is not needed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 8 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a double free (CWE-415) in the Windows Internet Information Services (IIS) web server, meaning a memory allocation is released twice, corrupting the heap and leading to a crash or other undefined behavior. Because IIS handles network requests, a remote unauthenticated attacker can send specially crafted traffic that triggers the double-free path, exhausting or corrupting process memory and denying service. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms network reachability with no authentication or user interaction, and the scope is unchanged (S:U) with high availability impact (A:H) only. No specific IIS module, HTTP handler, or Windows Server version is identified in the input data; the MSRC update guide is the authoritative source. The 'Authentication Bypass' tag present in the intelligence feed is not corroborated by the CVSS vector or CVE description, which describe an availability-only flaw, so it should be treated with caution.
Know when IIS gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable unauthenticated double free with no user interaction (AV:N/AC:L/PR:N/UI:N); DoS-only impact gives C:N/I:N/A:H and unchanged scope.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Double free in Windows Internet Information Services allows an unauthorized attacker to deny service over a network.
Executive ViewAI
Microsoft IIS is affected by a high-severity double-free vulnerability that allows unauthenticated remote attackers to crash the web server, causing a denial of service. While no data disclosure or code execution is possible, organizations relying on IIS for public-facing or internal web services face potential service outages that could disrupt business operations and customer access. Leadership should prioritize assessing exposure and preparing interim mitigations while awaiting a vendor patch.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict network access to IIS servers, deploy WAF rules to detect and block malformed requests, enable rate limiting, use load balancers with health checks and automated failover, monitor for unexpected IIS crashes, and disable unnecessary IIS features to reduce attack surface.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Realtek IIS Codec Service 6.4.10041.133 contains an unquoted service path vulnerability that allows local attackers to p
Unauthenticated .NET Remoting endpoint in Calero VeraSMART before 2022 R1. TCP port 8001 exposes default Object URIs ena
Static ASP.NET machineKey in Calero VeraSMART before 2022 R1. Hardcoded key enables ViewState deserialization attacks an
Information disclosure in Grav CMS before 2.0.25 lets unauthenticated remote attackers read sensitive files - configurat
Exploit-DB