Windows SMB Server EUVD-2026-73481

Exploitation requires network-level access to TCP port 445 on the target Windows host and at minimum a low-privilege authenticated session (PR:L per CVSS) - for example, a valid domain user account or any identity capable of completing SMB authentication. The Microsoft description does not cite any non-default SMB configuration as a prerequisite; SMB Server is enabled by default on Windows Server and Windows 10/11. Exploitation is bounded to availability impact only (A:H, C:N, I:N) - no data can be read or modified through this vector. The primary limiting factor is the authentication requirement, making this an insider threat or post-credential-compromise scenario rather than a fully unauthenticated external attack.

CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) reflects an accurate characterization: the attack is network-reachable, requires no interaction, and demands only a low-privilege credential such as a domain user account. The scope is unscoped (S:U), limiting the blast radius to the SMB Server process and host, with no lateral spillover into adjacent systems. No EPSS data was provided, and the CVE does not appear in CISA KEV, indicating no confirmed active exploitation at the time of analysis. Despite the moderate CVSS score, SMB's ubiquity in enterprise Windows environments means the practical exposure is broad - any environment with Windows file servers, domain controllers, or workstations accepting SMB connections from authenticated internal users carries meaningful risk from this flaw. The impact is purely availability-based (C:N/I:N/A:H), ruling out data exfiltration, but a sustained DoS against a Windows file server or domain controller could be severely disruptive to operations.

An attacker who holds a low-privilege domain user account - or who has compromised such an account - connects to a Windows file server or domain controller over TCP 445 and sends a crafted sequence of SMB requests that allocates server-side kernel resources without bound. As the server exhausts available memory or connection state, it stops responding to legitimate SMB clients, disrupting file access, authentication, and any services dependent on SMB. No public exploit code has been identified at time of analysis.