Windows DFS EUVD-2026-99510

Exploitation requires the attacker to already hold high privileges (PR:H) on the target - effectively administrative or equivalent elevated access to the Windows Distributed File System (DFS) service - and network reachability to that DFS endpoint (AV:N). No user interaction is required (UI:N) and attack complexity is low (AC:L), so once the privilege prerequisite is satisfied the overflow can be triggered reliably by sending crafted DFS traffic. The principal limiting factors are the high-privilege requirement, which prevents unauthenticated or low-privileged attackers from exploiting it, and the need for the DFS role/service to be deployed and network-exposed; environments that do not run DFS, or that restrict network access to DFS servers, are not exposed. SSVC's Automatable:no confirms this is not suitable for mass automated exploitation.

Multiple signals converge on this being a genuine but not top-tier priority. The CVSS 3.1 base score of 7.2 (High) with vector AV:N/AC:L/PR:H/UI:N reflects network-reachable, low-complexity exploitation that nonetheless requires PR:H - high privileges - which substantially gates abuse. CISA's SSVC framework reinforces a measured posture: Exploitation is 'none' (no observed or public exploitation), Automatable is 'no' (not amenable to mass/wormable exploitation, consistent with the PR:H authentication barrier), while Technical Impact is 'total' (full C:H/I:H/A:H compromise if exploited). There is no EPSS score provided, no CISA KEV listing, and no indication of public POC code, so the real-world exploitation likelihood is currently low despite the severe potential impact. In short, this is a high-impact but hard-to-reach flaw: an attacker already holding elevated/administrative privileges on a network-facing DFS service could achieve code execution, but there is no evidence of opportunistic, unauthenticated, or automated exploitation. Priority should be driven by exposure of DFS servers and the attacker's existing foothold, not by fear of indiscriminate attacks. No conflicting signals were found between the CVSS vector and the description - both agree on network vector with required privileges.

An attacker who has already obtained high-privilege (administrative-level) access to a network-reachable Windows DFS service sends specially crafted DFS protocol traffic that triggers a heap-based buffer overflow (CWE-122) in the DFS component, corrupting heap memory to execute arbitrary code over the network. Because the vector is AV:N/AC:L with no user interaction, exploitation is straightforward once the privilege prerequisite is met, but the PR:H requirement means this is most realistic as a privilege-leverage or lateral-movement step rather than an initial breach. No public exploit identified at time of analysis.