Windows SMB Server: Denial of service via unlimited resource allocation

Summary

A flaw in the Windows SMB Server component (file and printer sharing) allows resource allocation without limits or throttling (CWE-770). An unauthenticated attacker on the network can cause a denial of service, which can crash or stall the SMB service on affected systems. The attack needs no privileges or user interaction and does not grant access to data.

Affected

• Windows 10 Version 1607 (10.0.14393.0 to < 10.0.14393.9612)
• Windows 10 Version 1809 (10.0.17763.0 to < 10.0.17763.9376)
• Windows 10 Version 21H2 (10.0.19044.0 to < 10.0.19044.7807)
• Windows 10 Version 22H2 (10.0.19045.0 to < 10.0.19045.7807)
• Windows 11 Version 23H2 (10.0.22631.0 to < 10.0.22631.7652)
• Windows 11 Version 24H2 (10.0.26100.0 to < 10.0.26100.9711)
• Windows 11 Version 25H2 (10.0.26200.0 to < 10.0.26200.9711)
• Windows 11 Version 26H1 (10.0.28000.0 to < 10.0.28000.3231)
• Windows 11 Version 26H2 (10.0.26300.0 to < 10.0.26300.9711)
• Windows Server 2012 and Server Core (6.2.9200.0 to < 6.2.9200.26434)
• Windows Server 2012 R2 and Server Core (6.3.9600.0 to < 6.3.9600.23470)
• Windows Server 2016 (10.0.14393.0 to < 10.0.14393.9612)

Fixed in

• Windows 10 Version 1607 / Server 2016: build 10.0.14393.9612 (derived from the CNA range, to be verified on MSRC)
• Other versions: the first fixed build is listed in the MSRC Security Update Guide entry.
• KB numbers: unknown for 1607; do not assume KB numbers from other products apply.

Workaround

Unknown. No vendor workaround was found. Since a patch is available, the vendor fix is the primary action.

Exploitation

• Not known to be exploited in the wild.
• Microsoft rates exploitation as unlikely; the exploit code maturity is unproven.
• No public proof of concept found in the sources checked.
• CISA SSVC: exploitation none, automatable yes.
• Not listed in CISA KEV in the sources checked.

Our recommendation

• Identify all Windows hosts with the SMB server enabled, including Windows 10 and 11 clients and Windows Server systems.
• Patch 1607 systems first and verify the build number against the MSRC entry.
• Confirm that TCP 445 is not reachable from the internet or from untrusted segments such as guest or IoT networks.
• Monitor SMB availability and logs for unusual connection floods.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-70133 msrc.microsoft.com
• OpenCVE: CVE-2026-70133 app.opencve.io
• CVELIST via Vulners: CVE-2026-70133 vulners.com
• Strix: CVE-2026-70133 www.strix.ai
• Rapid7 via Vulners: CVE-2026-70133 vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 19:06.