Microsoft Windows eSCL Scanner: Use after free allows remote code execution

Summary

A use-after-free flaw in the Windows eSCL Scanner component allows an unauthenticated attacker to execute code over the network. eSCL is the driverless network scanning protocol built into Windows 10 and 11. The attack complexity is high and no user interaction or privileges are required.

Affected

• Windows 10 Version 21H2: builds 10.0.19044.0 to before 10.0.19044.7846
• Windows 10 Version 22H2: builds 10.0.19045.0 to before 10.0.19045.7846
• Windows 11 Version 23H2: builds 10.0.22631.0 to before 10.0.22631.7711
• Windows 11 Version 24H2: builds 10.0.26100.0 to before 10.0.26100.9974 (listed by the CVE record; not confirmed from a primary source)
• Windows 11 Version 25H2: builds 10.0.26200.0 to before 10.0.26200.9974 (listed by the CVE record; not confirmed from a primary source)
• Windows 11 Version 26H1: builds 10.0.28000.0 to before 10.0.28000.3501 (listed by the CVE record; not confirmed from a primary source)
• Windows 11 Version 26H2: builds 10.0.26300.0 to before 10.0.26300.9974 (listed by the CVE record; not confirmed from a primary source)
• Windows Server 2022: builds 10.0.20348.0 to before 10.0.20348.5870 (listed by the CVE record; not confirmed from a primary source)
• Windows Server 2025 (including Server Core): builds 10.0.26100.0 to before 10.0.26100.33822 (listed by the CVE record; not confirmed from a primary source)

Fixed in

• Windows 10 21H2: 10.0.19044.7846 or later
• Windows 10 22H2: 10.0.19045.7846 or later
• Windows 11 23H2: 10.0.22631.7711 or later
• Windows 11 24H2, 25H2, 26H1, 26H2, Server 2022 and Server 2025: see the builds listed above, to be verified on the MSRC advisory
• Fix availability for the 24H2 build is not confirmed from a primary source.

Workaround

Unknown. No vendor workaround was found in the sources. Patching is the available fix.

Exploitation

• CISA SSVC: exploitation none, automatable no, technical impact total.
• No public proof of concept found.
• EPSS score not available.
• Microsoft's exploited flag is not visible in the sources.

Our recommendation

• Verify the affected builds and fixes on the MSRC advisory before rollout.
• Identify all Windows 10 and 11 and Windows Server systems with network scanning enabled.
• Check whether Windows 10 21H2 and 22H2 machines are still covered by a support plan.
• Test the November 2026 update first, because a known issue affects some USB Audio Class 1.0 devices on Windows 10 21H2.
• Patch in the next cycle and, until patched, keep affected hosts off untrusted network segments and limit inbound traffic to the scanner subnet.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-95956 msrc.microsoft.com
• CVE Record CVE-2026-95956 (Microsoft CNA) www.cve.org
• Strix AI: CVE-2026-95956 (unverified secondary source) www.strix.ai
• SenServa KB 5131096 (exploitation status and known issue) senserva.com
• Zero Day Initiative: November 2026 Security Update Review www.zerodayinitiative.com
• PrinterArchive: eSCL protocol overview printerarchive.net

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 01:32.