Windows WLAN Service: Denial of service through out-of-bounds read

Summary

An out-of-bounds read in the Windows WLAN Service, the component that handles Wi-Fi connectivity, allows an unauthorized attacker to cause a denial of service. The attacker must be within radio range or on the same local network, as the attack vector is adjacent. No privileges or user interaction are required, and the impact is limited to availability, such as a crash or hang of the WLAN service.

Affected

• Windows 10 Version 21H2: 10.0.19044.0 to before 10.0.19044.7846
• Windows 10 Version 22H2: 10.0.19045.0 to before 10.0.19045.7846
• Windows 11 Version 23H2: 10.0.22631.0 to before 10.0.22631.7711 (CVE record lists this entry for ARM64 only)
• Windows 11 Version 24H2: 10.0.26100.0 to before 10.0.26100.9974 (fixed build not confirmed against MSRC)
• Windows 11 Version 25H2: 10.0.26200.0 to before 10.0.26200.9974
• Windows 11 Version 26H1: 10.0.28000.0 to before 10.0.28000.3501
• Windows 11 Version 26H2: 10.0.26300.0 to before 10.0.26300.9974
• Windows Server 2022: 10.0.20348.0 to before 10.0.20348.5870
• Windows Server 2025 (including Server Core): 10.0.26100.0 to before 10.0.26100.33822

Fixed in

• Fixed by the Microsoft November 2026 security updates (cumulative updates).
• Windows Server 2022: 10.0.20348.5870 (per aggregator data, KB5131090 per a third-party listing).
• Windows Server 2025: 10.0.26100.33822.
• Other versions: check the fixed build in the MSRC Security Update Guide, as the build numbers for Windows 11 23H2 and 24H2 are not confirmed.

Workaround

• Unknown. No vendor workaround was found in the sources.
• Interim measure (not from a vendor source): limit unnecessary Wi-Fi use on unpatched endpoints.
• Interim measure (not from a vendor source): disable the WLAN function on servers that do not need it.

Exploitation

• No evidence of exploitation known so far. CISA SSVC assessment: exploitation none, not automatable, partial technical impact.
• No public proof of concept or CISA KEV entry was found in a limited search.
• A Red Hat advisory mentioned in an OffSeq page concerns a Qt CVE and not this vulnerability.

Our recommendation

• Include the Microsoft November 2026 Windows updates in the next patch window.
• Prioritise laptops, tablets and Wi-Fi-enabled workstations in shared spaces such as offices, shops and guest networks.
• Check Windows 10 22H2 systems for Extended Security Update coverage.
• Confirm the exact fixed cumulative update for each Windows version in the MSRC Security Update Guide.
• Monitor the MSRC advisory for changes to exploitation status.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• CVE record (CNA: Microsoft) www.cve.org
• MSRC Security Update Guide advisory msrc.microsoft.com
• Strix aggregator (affected versions, scores) www.strix.ai
• Server 2022 update listing (exploitation flag) senserva.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 11:55.