Windows Function Discovery Resource Publication: Remote code execution via use-after-free

Summary

A use-after-free flaw in the Function Discovery Resource Publication (FDResPub) service of Windows allows remote code execution. An unauthenticated attacker on the same adjacent network can send specially crafted SOAP requests to an affected host, and successful exploitation could give full control over that host. Exploitation is rated as high complexity, and Microsoft has released fixes.

Affected

• Windows 10 Version 1607 (builds before 10.0.14393.9688)
• Windows 10 Version 1809 (builds before 10.0.17763.9487)
• Windows 10 Version 21H2 (builds before 10.0.19044.7846)
• Windows 10 Version 22H2 (builds before 10.0.19045.7846, third-party source only)
• Windows 11 Version 23H2 (builds before 10.0.22631.7711)
• Windows 11 Version 24H2, 25H2, 26H2 (fixed build unknown)
• Windows 11 Version 26H1 (builds before 10.0.28000.3501)
• Windows Server 2016, including Server Core (builds before 10.0.14393.9688)
• Windows Server 2019, including Server Core (builds before 10.0.17763.9487)
• Windows Server 2022 (builds before 10.0.20348.5870, third-party source only)
• Windows Server 2025 (fixed build unverified)

Fixed in

• Microsoft security update released 10 November 2026. Verify the exact fixed build per product in the MSRC Security Update Guide.
• Windows 10 1607: 10.0.14393.9688 or later
• Windows 10 1809: 10.0.17763.9487 or later
• Windows 10 21H2: 10.0.19044.7846 or later
• Windows 11 26H1: 10.0.28000.3501 or later
• Windows 10 22H2, Windows 11 23H2, Windows Server 2022: fixed builds only from a third-party tracker, to be checked against MSRC
• Windows 11 24H2, 25H2, 26H2 and Windows Server 2025: fixed build unknown
• Affected KB article: unknown.

Workaround

• No Microsoft-documented workaround. Apply the security update.
• If the Function Discovery Resource Publication service is not required, stop and disable it. Test first, because this may affect network discovery features.
• Restrict access to affected hosts with host or network firewall rules on the local segment. Port and protocol details are unconfirmed.

Exploitation

• No source reports this CVE as exploited in the wild. CISA SSVC lists exploitation as none and automatable as no.
• The CVSS vector carries E:U, meaning exploit maturity is unproven.
• No public proof of concept found. Status unknown.
• The NVD entry is still awaiting analysis.

Our recommendation

• Patch Windows 10, 11 and Server systems in the November 2026 update cycle, starting with hosts on flat networks, shared office or guest Wi-Fi, and segments with many unmanaged devices.
• Verify the installed build number after patching against the MSRC product table.
• Disable the FDResPub service on hosts where it is not required, after testing.
• Monitor for public exploit code or a CISA KEV listing and prioritise patching if one appears.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-125134 msrc.microsoft.com
• CVE.org record: CVE-2026-125134 www.cve.org
• Strix: CVE-2026-125134 (third-party, verify against MSRC) www.strix.ai
• Splashtop: Patch Tuesday November 2026 www.splashtop.com
• Tenable audit guidance on disabling FDResPub www.tenable.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 05:15.