Windows SSTP EUVD-2026-99626

Exploitation requires that the target Windows host has the Secure Socket Tunneling Protocol (SSTP) VPN service active and network-reachable - typically a machine configured as a Routing and Remote Access (RRAS) SSTP VPN gateway listening on TCP/443; SSTP is not enabled on default desktop/server installs, so hosts without the RRAS/VPN role configured are not exposed. No authentication is required (PR:N) and no user interaction is needed (UI:N), but the AC:H rating reflects that the attacker must reliably trigger and win the use-after-free race condition, which limits exploit reliability. Affected builds span Windows 10/11 (1607 through 26H2) and Windows Server 2012 through 2025 per EUVD; patched builds (e.g. 10.0.26100.9711 for 24H2) remove the exposure.

This is a serious but conditionally-gated flaw. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, score 8.1) describes a network-reachable, unauthenticated (PR:N) use-after-free in Windows SSTP yielding full C/I/A compromise - i.e. remote code execution. The single largest mitigating signal is AC:H: a use-after-free (CWE-416) over the network almost always implies a memory-timing/race condition the attacker must win, so reliable exploitation is non-trivial. No EPSS score, no KEV listing, and no POC are present in the input, so exploitation status is 'no public exploit identified at time of analysis' - this is NOT confirmed active exploitation despite the high base score. A key data conflict must be flagged: the input Tags include 'Denial Of Service', yet the CVSS vector and description both assert code execution with high integrity/confidentiality impact (I:H/C:H), so the DoS label understates the issue - treat it as RCE, not merely DoS. Net: a credible high-priority patch target because it is pre-auth network RCE affecting the ubiquitous Windows platform, but AC:H and the absence of any exploitation evidence argue it is not (yet) a drop-everything emergency relative to a PR:N/AC:L bug.

An attacker who can reach a Windows host running the SSTP VPN endpoint (TCP/443) sends a crafted sequence of SSTP protocol messages designed to trigger the use-after-free, winning the memory race to corrupt freed object state. On success, they achieve arbitrary code execution over the network without authentication; the AC:H rating means the race may require repeated attempts, and no public exploit code is currently identified.