Microsoft Windows DFS: Heap-based buffer overflow allows remote code execution

Summary

A heap-based buffer overflow in the Windows Distributed File System (DFS) allows an attacker to execute code over the network. The attacker needs a valid low-privilege account that can reach the affected system, and no user interaction is required. The CVSS 3.1 base score is 8.8 (High), with high impact on confidentiality, integrity and availability. The main risk is lateral movement from a compromised user account rather than direct internet attacks.

Affected

• Windows 10 Version 1607 (10.0.14393.0 to before 10.0.14393.9612)
• Windows 10 Version 1809 (10.0.17763.0 to before 10.0.17763.9376)
• Windows 10 Version 21H2 (10.0.19044.0 to before 10.0.19044.7807)
• Windows 10 Version 22H2 (10.0.19045.0 to before 10.0.19045.7807)
• Windows 11 Version 23H2 (10.0.22631.0 to before 10.0.22631.7652)
• Windows 11 Version 24H2 (10.0.26100.0 to before 10.0.26100.9711)
• Windows 11 Version 25H2 (10.0.26200.0 to before 10.0.26200.9711)
• Windows 11 Version 26H1 (10.0.28000.0 to before 10.0.28000.3231)
• Windows 11 Version 26H2 (10.0.26300.0 to before 10.0.26300.9711)
• Windows Server 2012 and 2012 (Server Core) (6.2.9200.0 to before 6.2.9200.26434)
• Windows Server 2012 R2 and 2012 R2 (Server Core) (6.3.9600.0 to before 6.3.9600.23470)
• Windows Server 2016 (10.0.14393.0 to before 10.0.14393.9612)

Fixed in

• Windows 10 Version 1607 / Windows Server 2016: build 10.0.14393.9612 or later (KB number: check the MSRC advisory)
• Windows 10 Version 1809: build 10.0.17763.9376 or later
• Windows 11 Version 24H2 and 25H2, Windows 11 Version 26H2: build 10.0.26100.9711 or later (25H2 and 26H2 builds as listed in the CVE record)
• Other versions: see the fixed builds in the MSRC advisory. The OpenCVE mirror lists a 22H2 build that appears to be a typo, so verify it on MSRC.

Workaround

Unknown.

Exploitation

• Microsoft reports exploit code maturity as Unproven (E:U) and no known exploitation at release.
• No CISA KEV listing was found in the sources checked.
• CISA SSVC: exploitation none, not automatable, total technical impact.
• EPSS 0.00851 (low predicted exploitation probability).

Our recommendation

• Inventory all Windows 10 1607, Windows Server 2016 and other affected hosts, including legacy file servers.
• Install the latest cumulative update from Microsoft that contains the fixed build for each version.
• Verify the end-of-support date of Windows 10 1607 on Microsoft's lifecycle site and plan an upgrade if it has passed or is near.
• Restrict SMB and DFS access to internal network segments and limit which accounts can reach file servers.
• Do not expose DFS to the internet and monitor for unusual SMB or DFS activity.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• MSRC advisory msrc.microsoft.com
• CNA/NVD mirror (vulners CVE list) vulners.com
• NVD mirror (vulners) vulners.com
• OpenCVE app.opencve.io
• Strix CVE page www.strix.ai
• VulDB vuldb.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 18:17.