Windows Deployment Services: Remote Code Execution (heap overflow)

Summary

A heap-based buffer overflow in Windows Deployment Services (WDS) allows an authorized attacker to execute code over the network. The attack complexity is high and the attacker needs low privileges, so a valid domain account or a foothold on the internal network is required. The CVSS 3.1 base score is 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Sources conflict on the affected and fixed versions, and one secondary source describes a related flaw as unauthenticated, so the vendor data must be checked before relying on it.

Affected

• Windows 10 Version 1607 (10.0.14393.0 to before 10.0.14393.9688)
• Windows 10 Version 1809 (10.0.17763.0 to before 10.0.17763.9487)
• Windows 10 Version 21H2 (10.0.19044.0 to before 10.0.19044.7846)
• Windows 10 Version 22H2 (10.0.19045.0 to before 10.0.19045.7846)
• Windows 11 Version 23H2 (10.0.22631.0 to before 10.0.22631.7711)
• Windows 11 Version 24H2 (10.0.26100.0 to before 10.0.26100.9974)
• Windows 11 Version 25H2 (10.0.26200.0 to before 10.0.26200.9974)
• Windows 11 Version 26H1 (10.0.28000.0 to before 10.0.28000.3501)
• Windows 11 Version 26H2 (10.0.26300.0 to before 10.0.26300.9974)
• Windows Server 2016 and Server Core installation (10.0.14393.0 to before 10.0.14393.9688)
• Windows Server 2019 and Server Core installation (10.0.17763.0 to before 10.0.17763.9487)
• Windows Server 2022 (10.0.20348.0 to before 10.0.20348.5870)
• Windows Server 2025: Unknown (not listed in the official CVE record; see fixed)

Fixed in

• Windows 10 Version 1809 and Windows Server 2019: build 10.0.17763.9487 (KB5131085)
• Windows 10 Version 21H2: build 10.0.19044.7846 (KB5131096, secondary source)
• Windows 10 Version 22H2: build 10.0.19045.7846 (KB5131096, secondary source)
• Windows Server 2025: build 10.0.26100.33822 (KB5131080). Unknown whether this is the fix for this CVE.
• Windows 10 Version 1607 and Windows Server 2016: Unknown
• Other listed versions: the fixed builds in the official record apply, verify against MSRC

Workaround

Unknown. No vendor workaround was found in the sources reviewed.

Exploitation

• CISA SSVC: exploitation none, automatable no, technical impact total
• Microsoft temporal vector: E:U (no public exploit code at publication) and RC:C
• No public proof-of-concept or exploitation reports specific to this CVE were found
• Rapid7 reports one in-the-wild exploited vulnerability in the November 2026 batch without naming it; whether it is this CVE is unknown

Our recommendation

• Identify WDS servers, for example with Get-WindowsFeature WDS-Deployment, and check whether PXE/WDS is still needed.
• Install the November 2026 security updates on all affected WDS servers as a priority.
• Until patched, limit WDS to a management VLAN and restrict who can reach it.
• Check the MSRC advisory for the exact fixed build for your version, because the sources conflict and a related CVE-2026-119951 is described as unauthenticated.
• Monitor WDS servers for unusual activity.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• MSRC Security Update Guide: CVE-2026-105558 msrc.microsoft.com
• CVE.org record CVE-2026-105558 www.cve.org
• Microsoft KB5131085 (Windows 10 1809 / Server 2019) support.microsoft.com
• Microsoft KB5131080 (Windows Server 2025) support.microsoft.com
• Pureinfotech: KB5131096 (Windows 10 ESU, secondary source) pureinfotech.com
• Rapid7: Patch Tuesday November 2026 www.rapid7.com
• Qualys: Patch Tuesday November 2026 review blog.qualys.com
• Strix.ai: CVE-2026-105558 (third-party tracker) www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 06:09.