EUVD-2026-56664
GHSA-3xxp-88xx-wwq3
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Network-reachable SMB client flaw requiring no attacker credentials or user interaction; impact strictly limited to memory disclosure with no integrity or availability consequence.
Primary rating from Vendor (microsoft).
CVSS VectorNVD
Lifecycle Timeline
7DescriptionNVD
Out-of-bounds read in Windows SMB Client allows an unauthorized attacker to disclose information over a network.
AnalysisAI
Remote information disclosure in the Windows SMB Client affects every actively-supported Windows 10, Windows 11, and Windows Server release from 2016 through 2025, exposing potentially sensitive memory contents to unauthenticated network attackers via a CWE-125 out-of-bounds read (CVSS 7.5). The flaw resides in the SMB client stack and is triggered when a vulnerable Windows host processes a crafted response from an attacker-controlled SMB server, requiring no authentication or user interaction from the attacker's perspective. No public exploit has been identified at time of analysis and CISA has not added this to the Known Exploited Vulnerabilities catalog; however, the extraordinary breadth of affected products and the vendor-confirmed patch make this a standard patch-cycle priority.
Technical ContextAI
Server Message Block (SMB) is Microsoft's proprietary network file-sharing protocol embedded in every Windows release and widely used for intra-network file, print, and inter-process communication services. This vulnerability is in the SMB client component - the code that parses and processes server-side protocol responses when a Windows system connects to a file share or SMB endpoint. CWE-125 (Out-of-Bounds Read) indicates the client reads memory beyond the intended buffer boundary when handling a maliciously crafted SMB server message, which can expose adjacent memory contents to the server operator. CPE data confirms affected architectures span x86, x64, and ARM64 across Windows 10 versions 1607, 1809, 21H2, and 22H2, while the EUVD affected-version list extends coverage to Windows 11 23H2, 24H2, 25H2, and 26H1, plus Windows Server 2016, 2019, 2022, and 2025 including Server Core installations. The tag list includes 'Buffer Overflow' alongside 'Information Disclosure', which likely reflects the underlying memory-safety class of error rather than a confirmed write primitive - the CVSS vector records I:N and A:N, indicating no write or denial-of-service capability has been established.
RemediationAI
Apply the Microsoft-released patch through Windows Update, WSUS, or an endpoint management platform targeting the following minimum fixed builds confirmed by EUVD-2026-56664: Windows 10 1607 and Server 2016 to 10.0.14393.9418 or later, Windows 10 1809 and Server 2019 to 10.0.17763.9115 or later, Windows 10 21H2 to 10.0.19044.7663 or later, Windows 10 22H2 to 10.0.19045.7663 or later, Windows Server 2022 to 10.0.20348.5499 or later, Windows 11 23H2 to 10.0.22631.7517 or later, Windows 11 24H2 to 10.0.26100.9168 or later, Windows Server 2025 and Server Core to 10.0.26100.33296 or later, Windows 11 25H2 to 10.0.26200.9168 or later, and Windows 11 26H1 to 10.0.28000.2704 or later. Where immediate patching is not feasible, implement host-based or network firewall rules blocking outbound SMB traffic (TCP 445 and TCP 139) from workstations and servers to any destination other than known, trusted internal file server addresses - this prevents SMB clients from connecting to attacker-controlled endpoints but will disrupt legitimate ad-hoc SMB connectivity and must be tested against application dependencies before deployment. The full vendor advisory is at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62782.
More in Windows 10 1607
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
The Win32k kernel-mode driver in Windows Vista through Windows Server 2016 allows local privilege escalation, exploited
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today