Windows Function Discovery SSDP Provider: Use-after-free remote code execution

Summary

A use-after-free vulnerability in the Windows Function Discovery SSDP Provider allows an unauthenticated attacker to execute code. The attacker needs to be on the same or an adjacent network segment, and the attack is rated as having high complexity. No privileges or user interaction are required. Successful exploitation could compromise confidentiality, integrity and availability of the affected system.

Affected

• Windows 10 Version 1607, 1809, 21H2 and 22H2
• Windows 11 Version 23H2, 24H2, 25H2 and 26H1 (version 26H2 is also listed in the CVE record)
• Windows Server 2016, 2019 and 2022, including Server Core installations
• Exact affected ranges: see the Microsoft Security Update Guide, as the CVE record text retrieved was incomplete

Fixed in

• Fixed in the November 2026 Patch Tuesday security update (cumulative update for each OS build)
• Fixed builds according to the CVE record (verify in the MSRC advisory before deployment): 10.0.14393.9688 (1607 and Server 2016), 10.0.17763.9487 (1809 and Server 2019), 10.0.19044.7846 (21H2), 10.0.19045.7846 (22H2), 10.0.22631.7711 (23H2), 10.0.20348.5870 (Server 2022), 10.0.26100.9974 (24H2), 10.0.26200.9974 (25H2), 10.0.26300.9974 (26H2), 10.0.28000.3501 (26H1)
• Build numbers for some versions differ between sources; confirm them in the MSRC advisory

Workaround

• No vendor workaround found in the sources reviewed. Unknown.
• Interim measure (not from vendor): restrict SSDP and discovery traffic on untrusted segments such as guest Wi-Fi
• Interim measure (not from vendor): disable the SSDP Discovery or Function Discovery services on hosts where they are not needed; test before rollout

Exploitation

• No evidence of exploitation in the wild found at the time of research
• Microsoft rates exploitation as Less Likely; CISA SSVC lists exploitation as none and not automatable
• No public proof of concept found; Exploit Code Maturity is Unproven
• NVD status: Awaiting Analysis

Our recommendation

• Read the full MSRC advisory and confirm the fixed build for each Windows version in use
• Inventory all Windows hosts by build number and identify unsupported systems (Windows 10 1607, 1809, 21H2 and 22H2) and Extended Security Updates enrolment
• Install the November 2026 security update, starting with servers and out-of-support systems
• Limit SSDP and discovery traffic between network zones and disable the service where it is not needed
• Monitor for new exploit reports and for NVD enrichment

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-118145 msrc.microsoft.com
• CVE Record CVE-2026-118145 www.cve.org
• Rapid7: Patch Tuesday November 2026 www.rapid7.com
• Talos: Microsoft Patch Tuesday November 2026 blog.talosintelligence.com
• Splashtop: Patch Tuesday November 2026 www.splashtop.com
• Strix mirror: CVE-2026-118145 www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 05:37.