What is the CVSS score of EUVD-2026-56318?

EUVD-2026-56318 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 1.0%.

Is there a patch available for EUVD-2026-56318?

Yes, a patch is available for EUVD-2026-56318. Update the affected software to the latest version immediately.

Windows Remote Registry EUVD-2026-56318

| CVE-2026-61345 MEDIUM

NULL Pointer Dereference (CWE-476)

2026-08-11 secure@microsoft.com

GHSA-859w-54qg-vr67

Denial Of Service Null Pointer Dereference Microsoft Windows 10 1607 Windows 10 1809 Windows 10 21h2 Windows 10 22h2 Windows 11 23h2 Windows 11 24h2 Windows 11 25h2 Windows 11 26h1 Windows Server 2012 Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows Server 2025

6.5

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

6.5 MEDIUM

Network-reachable RPC service requires low-privilege authentication; purely availability impact with no confidentiality or integrity consequence.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 23:15 vuln.today

Patch available

Aug 11, 2026 - 18:19 EUVD

CVE Published

Aug 11, 2026 - 17:18 cve.org

MEDIUM 6.5

DescriptionCVE.org

Null pointer dereference in Microsoft Remote Registry Service allows an authorized attacker to deny service over a network.

AnalysisAI

Remote Registry Service denial of service in Microsoft Windows allows network-authenticated attackers to crash the service via a crafted RPC request triggering a null pointer dereference. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms that any domain or local account with network access to the service is sufficient for exploitation - no elevated privileges required. No public exploit code has been identified and this vulnerability is not listed in CISA KEV at time of analysis.

Technical ContextAI

The Windows Remote Registry Service (winreg) implements the MS-RRP (Remote Registry Protocol) over RPC/SMB, enabling remote management of the Windows registry. CWE-476 (NULL Pointer Dereference) identifies the root cause: the service fails to validate a pointer before dereferencing it, likely during parsing of a malformed RPC request. This class of flaw in RPC-exposed services is particularly impactful because the service runs with SYSTEM or LocalService privileges, meaning a crash terminates the entire service process. The affected CPE range spans the Windows NT kernel family from build 6.2.9200 (Server 2012) through 10.0.28000 (Windows 11 26H1), indicating the vulnerable code path exists in a long-lived, shared component of the Windows RPC stack.

RemediationAI

Apply the vendor-released patches from Microsoft's July 2026 Patch Tuesday cycle. The exact fixed build versions per product are listed in ENISA EUVD-2026-56318 and the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-61345. Where immediate patching is not possible, the most effective compensating control is to disable the Remote Registry Service entirely via Group Policy or the Services console (services.msc → Remote Registry → set Startup Type to Disabled and stop the service) - note this will break remote registry management tools such as regedit remote connections and certain monitoring agents that rely on MS-RRP. Alternatively, restrict access to the service by blocking TCP port 445 and dynamic RPC ports (49152-65535) at the host firewall for untrusted network segments, limiting exposure to authenticated users on trusted VLANs only. Neither workaround replaces the patch, as they reduce exposure without eliminating the vulnerable code path.