EUVD-2026-99629
GHSA-rwgw-67hq-87vj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privilege network credentials
-
DeliverySend crafted request to Windows DFS service
-
ExploitTrigger heap-based buffer overflow (CWE-122)
-
ExecutionExecute arbitrary code on host
-
ImpactFull confidentiality, integrity and availability compromise
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to possess valid network-accessible credentials (PR:L - any authorized/authenticated account, not anonymous access) and network reachability to the Windows Distributed File System (DFS) service on a vulnerable host. The affected component is the DFS service present across Windows Server 2012 through 2025 and Windows 10/11 builds below the patched versions listed in EUVD. Limiting factors: the authentication requirement (PR:L) excludes fully unauthenticated attackers, CISA SSVC rates the issue 'not automatable', and no user interaction is required (UI:N) so there is no social-engineering gate. Applying the fixed build (e.g., Server 2025 >=10.0.26100.33650, Server 2019 >=10.0.17763.9376, Windows 11 24H2 >=10.0.26100.9711) removes the condition. |
| Impact | Signals conflict, which lowers urgency relative to the raw 8.8 CVSS. The CVSS vector (AV:N/AC:L/PR:L/UI:N) describes a network-reachable, low-complexity flaw requiring only low-privilege authentication, yielding full C:H/I:H/A:H impact - consistent with the CISA SSVC 'Technical Impact: total' rating. However, SSVC also records 'Exploitation: none' and 'Automatable: no', EPSS data is not provided, the CVE is not in CISA KEV, and no POC is referenced - so there is no public exploit identified at time of analysis. The requirement for valid credentials (PR:L) and the 'not automatable' judgment mean this is unlikely to see worm-style mass exploitation, but the combination of ubiquitous Windows footprint, Microsoft as the reporting source, a network vector, and total technical impact makes it a legitimate prioritized-patch item in Active Directory and file-server environments rather than a drop-everything emergency. The EPSS score is missing, so widespread-exploitation probability cannot be quantified from the available data. |
| Exploit ScenarioDerived | An attacker who already holds low-privilege domain credentials (e.g., any authenticated user) sends a specially crafted request over the network to the Windows DFS service, triggering a heap-based buffer overflow that corrupts memory and leads to arbitrary code execution on the target host. No user interaction is required and attack complexity is low, but valid authentication is needed. No public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Heap-based buffer overflow in the Windows Distributed File System (DFS) allows an authenticated, network-positioned attacker to execute arbitrary code on a vulnerable host, carrying high confidentiality, integrity, and availability impact (CVSS 8.8). Affected platforms span Windows Server 2012 through Server 2025 and Windows 10/11 builds below the fixed builds catalogued by ENISA EUVD, and exploitation requires valid network-accessible credentials (PR:L per the CVSS vector) plus reachability to the DFS service - the authentication requirement and the absence of user interaction are the two defining gates. Exploitation status is currently benign: CISA's SSVC assessment rates Exploitation as none and Automatable as no, there is no KEV listing, and no public exploit identified at time of analysis, so the practical urgency is lower than the raw 8.8 score suggests.
RemediationAI
Apply the vendor-released Microsoft security update for CVE-2026-85931 through Windows Update, WSUS, or the Microsoft Update Catalog, using the advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85931 as the authoritative source; patch status is 'available from vendor' with fixed build levels set out in the EUVD ranges - Server 2025 at or above 10.0.26100.33650, Server 2022 at or above 10.0.20348.5761, Server 2019 at or above 10.0.17763.9376, Server 2016 at or above 10.0.14393.9612, Server 2012 R2 at or above 6.3.9600.23470, Server 2012 at or above 6.2.9200.26434, Windows 10 21H2/22H2 at or above 10.0.19044.7807, Windows 10 1809 at or above 10.0.17763.9376, Windows 10 1607 at or above 10.0.14393.9612, Windows 11 23H2 at or above 10.0.22631.7652, Windows 11 24H2 at or above 10.0.26100.9711, and Windows 11 26H1/26H2 at or above 10.0.28000.3231 and 10.0.26300.9711. Because exploitation requires PR:L credentials and network reachability, the most effective interim control is to restrict who can reach the DFS service: scope DFS/SMB and DFS RPC traffic to trusted internal subnets and hosts via host firewall and network ACLs, accepting as a trade-off that cross-site or branch file-sharing and DFS Replication topologies will need explicit allow-listing or may break. Where DFS Namespaces or DFS Replication are not operationally required, remove the role entirely (trade-off: loss of namespace abstraction and multi-master replication). Enforce least privilege so that only genuine file-service accounts hold credentials usable against DFS hosts (trade-off: administrative overhead and possible login failures for over-privileged legacy accounts), and alert on unusual authenticated DFS/SMB activity. Note that exploitation is currently assessed as not automatable and no public exploit has been identified, so these compensating controls can be prioritized behind standard patch-cycle rollout rather than emergency outage-inducing changes.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 20 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-122 (heap-based buffer overflow): a memory-allocation size for an attacker-influenced buffer is miscalculated on the Windows DFS service, so a crafted request causes data to be written past the end of a heap allocation, corrupting adjacent heap metadata and enabling controlled code execution in the context of the DFS service. Windows DFS is a long-standing Microsoft service set used for namespace aggregation and replication across file servers; it is reachable over the network via SMB/RPC, which places it in the standard Windows remote attack surface of file-server roles. The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H confirms the attack is network-delivered with low complexity and no user interaction, but explicitly requires low privileges - i.e., any valid authenticated account, not anonymous access. Because ENISA EUVD enumerates the issue against kernel build ranges for Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025 (including Server Core installations) and Windows 10 1607/1809/21H2/22H2 plus Windows 11 23H2/24H2/25H2/26H1/26H2, the affected component travels with the operating system on both server and client SKUs rather than being a standalone add-on. No scope change (S:U) means the overflow is contained to the DFS service's own security context, though that context is typically privileged on a file server, so post-exploitation impact should still be treated as significant. CISA SSVC flags Technical Impact as total, consistent with a memory-corruption primitive that yields code execution.
Know when Windows gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
DFS is network-reachable with low complexity (AV:N/AC:L); an 'authorized attacker' needs valid low-privilege credentials (PR:L); code execution yields total impact (C/I/A:H).
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Heap-based buffer overflow in Windows Distributed File System (DFS) allows an authorized attacker to execute code over a network.
Executive ViewAI
A heap-based buffer overflow in Microsoft's Windows Distributed File System (DFS) service affects Windows Server 2012 through Server 2025 and Windows 10/11, and could let an attacker with valid network credentials run arbitrary code on a file server with full control over its data and availability. Because DFS underpins shared file access and namespace routing across most enterprise environments, a successful compromise could disrupt business file services and give an intruder a foothold for lateral movement toward higher-value systems. There is no evidence of active exploitation or public exploit code at this time, but the broad install base and severity of a code-execution flaw on a core file service warrant prioritized remediation rather than emergency response.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Twonky Server 8.5.2 uses hard-coded cryptographic keys for encrypting the administrator password. Combined with the cred
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Exploit-DB