Windows Deployment Services EUVD-2026-73112

Exploitation requires: (1) the target Windows Server has the Windows Deployment Services role explicitly installed and the service running - WDS is not active by default on any Windows Server SKU; (2) the attacker holds at least a low-privilege network credential sufficient to interact with the WDS service (PR:L - 'authorized attacker'); (3) the attacker has network-layer reachability to the WDS service ports (TFTP/RPC); and (4) the attack complexity is high (AC:H), meaning a race condition or specific heap state must be achieved, ruling out simple single-packet exploitation. Exploitation is limited by: the need for valid credentials (eliminates unauthenticated remote attacks), the non-default WDS role installation, the AC:H requirement for heap grooming or race-condition timing, and no public exploit code at time of analysis.

CVSS 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects a network-reachable RCE with full CIA impact but constrained by high attack complexity and a requirement for at least low-privilege credentials. AC:H for a UAF typically implies a race condition, specific heap state, or heap-grooming requirement that makes reliable exploitation non-trivial. The 'authorized attacker' framing in the description aligns with PR:L - an attacker needs a valid domain or WDS account, which limits the exposed attack surface compared to unauthenticated scenarios. No public exploit or CISA KEV listing has been identified, and EPSS data was not provided; given AC:H and PR:L, opportunistic mass exploitation is unlikely. The risk is most acute in enterprise environments running WDS for OS provisioning where adversaries with low-level credentials (e.g., post-phishing) could pivot to the WDS server. The 'Denial Of Service' tag in the metadata understates the actual impact - the description and CVSS C:H/I:H/A:H triad confirm full RCE as the primary threat.

An attacker with a compromised low-privilege domain account sends specially crafted network requests to the WDS service, triggering a race condition that causes a freed memory object to be dereferenced. By grooming the heap to place attacker-controlled data in the reallocated region before the dangling pointer is used, the attacker redirects execution and achieves code execution in the context of the WDS service process. No public proof-of-concept has been identified, but the AC:H constraint means a skilled attacker with network access and valid credentials could develop working exploit code given sufficient reverse-engineering of the patch.