EUVD-2026-73671
GHSA-9877-5hg9-cv9g
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local attack requiring low-privilege session (PR:L); AC:L as no special race or configuration beyond WDS role presence; full C/I/A impact from code execution as SYSTEM.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Heap-based buffer overflow in Windows Deployment Services allows an authorized attacker to execute code locally.
AnalysisAI
Heap-based buffer overflow in Windows Deployment Services (WDS) allows a locally authenticated low-privileged attacker to execute arbitrary code, effectively achieving local privilege escalation on affected Windows Server and Windows 10 systems. The flaw spans a wide range of Microsoft server OS versions from Windows Server 2012 through Windows Server 2025, as well as Windows 10 builds 1607 and 1809. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated local session with at minimum low-privilege access (PR:L per CVSS) on a Windows system where the Windows Deployment Services role is installed and running. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 7.8 with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H accurately reflects this as a local privilege escalation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor-released patch immediately via Windows Update or WSUS, targeting the specific minimum build versions listed per OS version (e.g., 10.0.26100.33438 for Server 2025, 10.0.20348.5622 for Server 2022, 10.0.17763.9245 for Server 2019, 10.0.14393.9512 for Server 2016, 10.0.20348.5622 for Server 2022). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify and enumerate all Windows Server 2012-2025 and Windows 10 systems running Windows Deployment Services in your environment. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today