EUVD-2026-73112
GHSA-gm9q-6xgv-qx45
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-accessible service (AV:N), UAF race-condition complexity (AC:H), authorized-attacker requirement (PR:L), full RCE impact on vulnerable system (C:H/I:H/A:H).
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
4DescriptionCVE.org
Use after free in Windows Deployment Services allows an authorized attacker to execute code over a network.
AnalysisAI
Use-after-free in Windows Deployment Services (WDS) allows authenticated network attackers to execute arbitrary code on affected Windows Server hosts ranging from Server 2012 through Server 2025. The CVSS vector (AV:N/AC:H/PR:L) confirms network reachability but requires at least low-privilege credentials and elevated exploitation complexity, consistent with the description's 'authorized attacker' phrasing. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) the target Windows Server has the Windows Deployment Services role explicitly installed and the service running - WDS is not active by default on any Windows Server SKU; (2) the attacker holds at least a low-privilege network credential sufficient to interact with the WDS service (PR:L - 'authorized attacker'); (3) the attacker has network-layer reachability to the WDS service ports (TFTP/RPC); and (4) the attack complexity is high (AC:H), meaning a race condition or specific heap state must be achieved, ruling out simple single-packet exploitation. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects a network-reachable RCE with full CIA impact but constrained by high attack complexity and a requirement for at least low-privilege credentials. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the Microsoft security update corresponding to the affected OS version via Windows Update or WSUS: patch to 6.2.9200.26349 or later for Server 2012; 6.3.9600.23397 for Server 2012 R2; 10.0.14393.9512 for Server 2016 and Windows 10 1607; 10.0.17763.9245 for Server 2019 and Windows 10 1809; 10.0.20348.5622 for Server 2022; and 10.0.26100.33438 for Server 2025. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Windows Server 2012-2025 systems running WDS and audit network access to ensure usage is restricted to authorized administrators only, minimizing exposure to low-privileged accounts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-416 – Use After Free
View allSame technique Use After Free
View allShare
External POC / Exploit Code
Leaving vuln.today