EUVD-2026-35757
GHSA-9wx6-gp73-qg3j
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Use after free in Windows Deployment Services allows an unauthorized attacker to execute code over a network.
AnalysisAI
Remote code execution in Microsoft Windows Deployment Services (WDS) allows unauthenticated network-based attackers to execute arbitrary code by exploiting a use-after-free memory corruption flaw (CWE-416). The CVSS 8.1 score reflects high impact on confidentiality, integrity, and availability, though exploit complexity is rated High. No public exploit identified at time of analysis, and SSVC marks exploitation status as none with the flaw classified as not automatable.
Technical ContextAI
Windows Deployment Services is a Microsoft Windows Server role used to network-deploy Windows operating systems via PXE boot, typically in enterprise imaging and provisioning workflows. The underlying defect is a use-after-free (CWE-416), a memory-safety bug where freed heap memory is dereferenced again, enabling attackers to corrupt allocator metadata, hijack object virtual function pointers, or otherwise redirect control flow. Because WDS exposes network-facing services (TFTP and related WDS protocols) to facilitate boot and image transfer, the vulnerable code path is reachable by remote unauthenticated peers on the same network segment as the WDS server.
RemediationAI
Apply the vendor-released patch from Microsoft per the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42987, following the monthly Patch Tuesday update channel for the affected Windows Server SKUs running the WDS role. If patching must be deferred, the most effective compensating control is to restrict network reachability of the WDS server: block inbound TFTP (UDP/69) and WDS-related ports at the network boundary so only trusted imaging VLANs can reach the service, accepting that this will break PXE deployments outside those segments. Where WDS is not in active use, stop and disable the WDSServer service (Windows Deployment Services role) - a zero-side-effect mitigation for sites that no longer rely on WDS-based imaging. Additional advisory context is available at https://vuldb.com/vuln/369633.
More in Windows Server 2012
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Remote code execution in Microsoft Office 2007-2016 and Windows Vista through 10 allows attackers to execute arbitrary c
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
The Win32k kernel-mode driver in Windows Vista through Windows Server 2016 allows local privilege escalation, exploited
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Active Directory Domain Services Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.5), this vulnerabilit
Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today