EUVD-2026-73040
GHSA-qqjh-c63r-j3mw
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable heap overflow requiring only low-privilege credentials; low complexity, no interaction, full CIA impact on unscoped vulnerable system.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Heap-based buffer overflow in Windows Credential Providers allows an authorized attacker to execute code over a network.
AnalysisAI
Heap-based buffer overflow in Windows Credential Providers enables a low-privileged authenticated attacker to execute arbitrary code over the network on affected Windows 11 and Windows Server 2025 systems. The flaw (CWE-122) is reachable via network with low complexity and no user interaction required, making it exploitable by any account holder with minimal privileges. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a low-privileged authenticated account (PR:L per CVSS vector) with network access to the target (AV:N). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.8 score with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H represents a high-severity, network-reachable vulnerability requiring only low-privilege credentials and no user interaction, with full confidentiality, integrity, and availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the Microsoft security update to bring affected systems to the fixed builds: Windows Server 2025 to build 10.0.26100.33438 or later, Windows 11 24H2 to 10.0.26100.9445 or later, Windows 11 25H2 to 10.0.26200.9445 or later, and Windows 11 26H1 to 10.0.28000.2954 or later. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify and inventory all Windows 11 and Windows Server 2025 systems in the organization, prioritizing those running critical services or containing sensitive data. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today