Windows: Denial of service in Netlogon due to use-after-free

Summary

Windows Netlogon, the component that handles authentication for domain logons, contains a use-after-free flaw (CWE-416). An authenticated attacker on the network can crash or hang the service, which can disrupt domain logons, especially on domain controllers. Microsoft describes the impact as denial of service only.

Affected

• Windows 10 Version 1607 (10.0.14393.0 before 10.0.14393.9612)
• Windows 10 Version 1809 (10.0.17763.0 before 10.0.17763.9376)
• Windows 10 Version 21H2 (10.0.19044.0 before 10.0.19044.7807)
• Windows 10 Version 22H2 (10.0.19045.0 before 10.0.19045.7807)
• Windows 11 Version 23H2 (10.0.22631.0 before 10.0.22631.7652)
• Windows 11 Version 24H2 (10.0.26100.0 before 10.0.26100.9711)
• Windows 11 Version 25H2 (10.0.26200.0 before 10.0.26200.9711)
• Windows 11 Version 26H1 (10.0.28000.0 before 10.0.28000.3231)
• Windows 11 Version 26H2 (10.0.26300.0 before 10.0.26300.9711)
• Windows Server 2012 (6.2.9200.0 before 6.2.9200.26434), including Server Core
• Windows Server 2012 R2 (6.3.9600.0 before 6.3.9600.23470), including Server Core
• Windows Server 2016 (10.0.14393.0 before 10.0.14393.9612)

Fixed in

• Windows 10 Version 1607 and Windows Server 2016: 10.0.14393.9612
• Windows 10 Version 1809: 10.0.17763.9376
• Windows 10 Version 21H2: 10.0.19044.7807
• Windows 10 Version 22H2: 10.0.19045.7807
• Windows 11 Version 23H2: 10.0.22631.7652
• Windows 11 Version 24H2 and 25H2, Version 26H2: 10.0.26100.9711 (24H2), 10.0.26200.9711 (25H2), 10.0.26300.9711 (26H2)
• Windows 11 Version 26H1: 10.0.28000.3231
• Windows Server 2012 and Server 2012 R2: see the Microsoft Security Update Guide for the fixed build

Verify the build and KB numbers in the Microsoft Security Update Guide before rollout.

Workaround

• No vendor workaround known.
• Restrict access to Netlogon and RPC to internal management and domain networks.
• Do not disable Netlogon on domain controllers, as this breaks domain logons.

Exploitation

• Microsoft: not publicly disclosed, not exploited, exploitation unlikely.
• CISA SSVC: exploitation none, not automatable.
• No public proof-of-concept found.

Our recommendation

• Inventory all Windows 10 1607 and Server 2016 hosts, including devices that are not domain members.
• Install the fixed build on all affected systems, starting with domain controllers.
• Windows 10 1607 LTSB reached end of support on 13 October 2026. Enrol devices in Extended Security Updates or replace them, and confirm with Microsoft that ESU delivers this fix.
• Make sure Netlogon and RPC are not reachable from the internet or untrusted networks.
• Re-check the CVSS vector: the record shows AC:L (6.5), while the vendor data reportedly shows AC:H (5.3).

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-70025 msrc.microsoft.com
• NVD mirror: CVE-2026-70025 (Vulners) vulners.com
• OpenCVE: CVE-2026-70025 app.opencve.io
• 4sysops: Windows 10 LTSB 2016 end of support 4sysops.com
• Microsoft Tech Community: Windows Server 2016 and Windows 10 LTSB end of support techcommunity.microsoft.com
• heise: Windows 10 LTSB and Server 2016 support ends www.heise.de

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 5 Nov 2026, 11:23.