CVE-2026-72957 – Windows Deployment Services Remote Code Execution Vulnerability

CVE-2026-72957 is a critical heap-based buffer overflow vulnerability (CWE-122) in Windows Deployment Services. An authenticated attacker with low privileges can trigger the vulnerability locally and execute code without requiring user interaction. Although the title describes remote code execution, the attack vector is local; “Remote” refers to the location of the attacker, while exploitation requires code to be executed on the local machine.

CVSS SCORE: 7.8.

SEVERITY: Critical.

THREAT: Successful exploitation could allow an authenticated attacker to execute arbitrary code on an affected Windows system. The vulnerability has low attack complexity, requires only low privileges, and requires no user interaction. A successful attack can have a high impact on confidentiality, integrity, and availability.

EXPLOITS: The vulnerability is not publicly disclosed and is not reported as exploited. Exploit code maturity is classified as Unproven, so the source does not confirm the existence of a public exploit, zero-day exploitation, or proof-of-concept exploit code.

TECHNICAL SUMMARY: The vulnerability is caused by a heap-based buffer overflow in Windows Deployment Services. An authenticated attacker can trigger the flaw with low privileges, potentially causing memory corruption that results in arbitrary code execution. The CVSS attack vector is Local with Low attack complexity, Low privileges required, and no user interaction. Scope remains unchanged, while successful exploitation can have High confidentiality, integrity, and availability impacts. An official fix is available.

EXPLOITABILITY: Affected software includes Windows 10 versions 1607 and 1809 (32-bit and x64), Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including the listed Server Core installations. Exploitation requires an authenticated attacker with low privileges to trigger the vulnerability locally; no user interaction is required.

BUSINESS IMPACT: Successful exploitation could enable arbitrary code execution and lead to serious compromise of affected Windows systems. With confidentiality, integrity, and availability all rated High for impact, organizations could face exposure or modification of sensitive information and disruption of critical systems or services. The low attack complexity and lack of required user interaction increase the importance of addressing affected systems promptly.

WORKAROUND: No mitigations or workarounds are identified. An official fix is available, and the listed updates require a restart.

URGENCY: This vulnerability is rated Critical and can result in arbitrary code execution with High impact across confidentiality, integrity, and availability. Although exploitation is not currently reported and exploit maturity is Unproven, affected systems should be prioritized for deployment because exploitation requires only low privileges, has low attack complexity, and requires no user interaction.