CVE-2026-71331 – Windows Device Health Attestation (DHA) Remote Code Execution Vulnerability

CVE-2026-71331 is a critical remote code execution vulnerability in Windows Device Health Attestation (DHA). The vulnerability involves integer overflow or wraparound and heap-based buffer overflow weaknesses. An unauthenticated attacker could send a specially crafted packet to an affected service over the network and potentially execute code on the target system. Exploitation requires no privileges or user interaction, although the attack complexity is rated High.

CVSS Score: 8.1.

SEVERITY: Critical.

THREAT:
The vulnerability can be attacked remotely over a network and could result in high confidentiality, integrity, and availability impact. Successful exploitation could allow an unauthenticated attacker to execute code on the targeted system. Attack complexity is High, meaning exploitation depends on a combination of factors and requires a deep understanding of the system.

EXPLOITS:
The vulnerability is not publicly disclosed and is not reported as exploited. Exploit Code Maturity is rated Unproven. The source does not confirm the existence of public exploit code, zero-day exploitation, or proof-of-concept exploit code.

TECHNICAL SUMMARY:
The vulnerability is associated with CWE-190 Integer Overflow or Wraparound and CWE-122 Heap-based Buffer Overflow weaknesses in Windows Device Health Attestation. An unauthenticated attacker could send a specially crafted packet to an affected service over the network. Successful exploitation could lead to remote code execution on the target system, with potentially high impact to confidentiality, integrity, and availability. No privileges or user interaction are required. However, exploitation has High attack complexity, is not guaranteed, and can depend on the environment, system configuration, and additional security measures.

EXPLOITABILITY:
Affected products include Windows 10 Version 1809 for 32-bit and x64-based systems, Windows Server 2019, Windows Server 2022, Windows Server 2025, and the listed Server Core installations. An unauthenticated attacker could exploit the vulnerability by sending a specially crafted network packet to an affected service.

BUSINESS IMPACT:
Successful exploitation could allow remote code execution and potentially compromise sensitive information, system integrity, and service availability. For organizations operating affected Windows servers or endpoints, a successful attack could lead to system compromise and disruption of business services.

WORKAROUND:
No workaround or mitigation is specified. An official fix is identified, so affected systems should be updated using the applicable security update.

URGENCY:
This vulnerability is rated Critical and can enable remote code execution without authentication or user interaction. Although exploitation is considered less likely and attack complexity is High, the potential impact across confidentiality, integrity, and availability makes prompt deployment important.