EUVD-2026-43986
GHSA-q56f-qhqm-x6f8
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network attacker triggers the overflow with no user interaction (AV:N/AC:L/PR:N/UI:N); heap RCE in the service yields full C:H/I:H/A:H, though the FTP role must be enabled.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Heap-based buffer overflow in Windows FTP Service allows an unauthorized attacker to execute code over a network.
AnalysisAI
Remote code execution in the Microsoft Windows FTP Service allows an unauthenticated network attacker to run arbitrary code by triggering a heap-based buffer overflow (CWE-122). The flaw affects the FTP service across a broad range of Windows 10, Windows 11, and Windows Server (2019/2022/2025) builds and carries a critical CVSS 9.8 rating with no authentication or user interaction required. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated, network-reachable nature of the bug makes it a high-priority patch target.
Technical ContextAI
The vulnerable component is Microsoft's FTP service, the file-transfer server role that ships with IIS on Windows client and server SKUs. The root cause is classified as CWE-122 (Heap-based Buffer Overflow), meaning attacker-controlled input - most likely an oversized or malformed FTP command/argument - is written past the bounds of a heap-allocated buffer during request parsing. Heap corruption of this kind can be leveraged to overwrite adjacent allocation metadata or function pointers, enabling control-flow hijack and arbitrary code execution in the context of the FTP service process. CPE data confirms the affected platform is the 'microsoft' vendor across Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1), and Windows Server 2019, with tags extending coverage to Windows Server 2022 and 2025 including Server Core installations.
RemediationAI
Patch available per vendor advisory - apply the Microsoft security update for CVE-2026-49172 to all affected Windows 10, Windows 11, and Windows Server 2019/2022/2025 systems (including Server Core) via Windows Update or your patch-management tooling, using the build-specific fixed versions listed at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49172 (exact fix build numbers were not provided in this input and should be taken from that advisory). As a compensating control where immediate patching is not possible, disable or uninstall the FTP service/IIS FTP role on hosts that do not require it, which fully removes the attack surface at the cost of ending legitimate FTP file transfer on those hosts. If the service must remain running, restrict inbound access to the FTP control and data ports (TCP 21 and the passive/data port range) with host and perimeter firewalls so only trusted management networks can reach it, accepting that this breaks access for any legitimate external clients.
More in Windows 10 Version 1607
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to run arbitr
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem
Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating
Remote code execution in Microsoft Windows Remote Desktop (RDP) allows an unauthorized network attacker to run arbitrary
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Heap Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today