Windows Deployment Services EUVD-2026-73708

The Windows Deployment Services server role must be installed and running - this is an optional component not present on all Windows Server deployments. The CVSS vector UI:R indicates that a client system must initiate or complete some form of interaction with the WDS service (such as initiating a PXE boot session) to trigger the vulnerable code path; purely passive server exploitation without client participation is not indicated. AC:H reflects that reliable exploitation requires overcoming heap layout uncertainty, consistent with memory-corruption primitives. No authentication is required (PR:N), meaning any network host that can reach the WDS service on its listening ports can attempt exploitation. Exploitation is limited by: (1) WDS role must be explicitly installed, (2) attacker must reach WDS network ports (typically firewalled to internal provisioning VLANs), (3) high attack complexity demands precise heap state control.

The Microsoft-provided CVSS 7.5 (AV:N/AC:H/PR:N/UI:R) reflects realistic exploitation difficulty: although no authentication is required and the attack is network-based, AC:H and UI:R together indicate that successful exploitation demands precise heap grooming conditions and some triggering interaction from a client system. The triple-high C:H/I:H/A:H impact accurately reflects that successful UAF exploitation on a WDS server can yield full code execution in the WDS service context. WDS servers are typically deployed only on internal enterprise networks for OS provisioning - internet exposure is rare and would be a severe misconfiguration. No EPSS data was provided, and there is no CISA KEV listing, suggesting this has not yet been observed in active exploitation campaigns. The 'Denial Of Service' tag in the input understates the true impact: the description explicitly confirms code execution, not merely a crash. The real-world priority is HIGH for organizations running WDS as a core infrastructure service, but LOW for the general internet-exposed population given the internal-only deployment pattern and AC:H exploitation bar.

An attacker on the same network segment as a WDS server (or able to reach it via routable access to the provisioning VLAN) sends a crafted PXE or WDS protocol request that triggers the use-after-free condition in the WDS service process. After performing heap grooming to control the freed memory region, the attacker triggers a second dereference, redirecting execution to attacker-controlled shellcode or a ROP chain, achieving code execution on the WDS server in the context of the WDS service account. No public proof-of-concept has been identified at time of analysis, and successful exploitation requires AC:H heap manipulation.