Microsoft Windows: Remote code execution in Link Layer Topology Discovery

Summary

A use-after-free vulnerability in the Windows Link Layer Topology Discovery (LLTD) protocol allows code execution on affected Windows systems. The attacker must be on the same adjacent network segment, and the attack complexity is high. No privileges or user interaction are required, according to the CVSS vector. Exploitation has not been reported and no public exploit was found at the time of writing.

Affected

• Windows 10 Version 1607 and Windows Server 2016 (including Server Core): builds before 10.0.14393.9688
• Windows 10 Version 1809 and Windows Server 2019 (including Server Core): builds before 10.0.17763.9487
• Windows 10 Version 21H2: builds before 10.0.19044.7846
• Windows 10 Version 22H2: builds before 10.0.19045.7846 (per secondary aggregator, unverified against vendor page)
• Windows 11 Version 23H2: builds before 10.0.22631.7711 (per CNA record, listed twice)
• Windows 11 Version 24H2 and 25H2: builds before 10.0.26100.9974 and 10.0.26200.9974
• Windows 11 Version 26H1: builds before 10.0.28000.3501
• Windows 11 Version 26H2: builds before 10.0.26300.9974
• Windows Server 2022: builds before 10.0.20348.5870

Fixed in

Unknown. Install the Microsoft security update for the affected build; the fixed builds are the first builds at or above the values listed above. KB article numbers were not confirmed.

Workaround

No Microsoft-published workaround is known. As hardening, the Link-Layer Topology Discovery Mapper service (lltdsvc) can be set to Disabled, which stops the Network Map feature from working. CIS benchmarks list the default value as Manual.

Exploitation

• No evidence of exploitation in the wild found.
• CISA KEV listing not mentioned in any source found.
• No public proof of concept found.
• CISA SSVC: exploitation none, not automatable, total technical impact.

Our recommendation

• Patch affected Windows 10, Windows 11 and Windows Server systems in the next regular update cycle; verify the affected list and KB numbers on the Microsoft Security Update Guide.
• Check whether the lltdsvc service is running and disable it where Network Map is not needed.
• Segment guest Wi-Fi and flat networks so that untrusted devices cannot reach internal systems on the same segment.
• Monitor for public exploit reports and raise the priority if exploitation is reported.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-88244 msrc.microsoft.com
• CVE Record: CVE-2026-88244 www.cve.org
• VulDB: CVE-2026-88244 vuldb.com
• Strix: CVE-2026-88244 www.strix.ai
• Wikipedia: Link Layer Topology Discovery en.wikipedia.org
• Tenable CIS audit item: Windows 7 Level 2 (lltdsvc) www.tenable.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 05:06.