Windows BranchCache EUVD-2026-73457

Exploitation requires that the BranchCache feature is installed and the BranchCache service is running on the target Windows system. BranchCache is not enabled by default on Windows - it must be explicitly deployed via Group Policy or manual configuration in either Distributed Cache or Hosted Cache mode. Systems without BranchCache installed or configured are not exposed. Exploitation is unauthenticated and requires only network-layer reachability to the BranchCache service port (typically TCP 80 or the configured Hosted Cache port). There is no required user interaction.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H yields a base score of 7.5, which accurately reflects a straightforward, unauthenticated, network-reachable DoS with no confidentiality or integrity impact. EPSS data is not present in the input, and this CVE is not listed in CISA KEV, indicating no confirmed active exploitation. No public proof-of-concept has been identified. Real-world risk is constrained by the fact that BranchCache is not enabled by default and must be explicitly deployed; organizations without BranchCache are not exposed. Where BranchCache is in use (branch-office enterprise environments), availability impact could be significant since a crash disrupts local content caching and potentially disrupts dependent network operations. The two supplied tags ('Buffer Overflow' and 'Information Disclosure') are both inaccurate and should not inform triage - the actual impact is availability-only DoS via an out-of-bounds read.

An attacker on the same network segment as a Windows system running BranchCache sends a specially crafted malformed BranchCache protocol request. The BranchCache service reads beyond a buffer boundary while processing the message, triggering a service crash. No authentication is required, and the attack can be repeated to maintain persistent denial of service against the caching infrastructure.