Executive brief
Microsoft Windows Deployment Services, a tool used by IT administrators to install Windows operating systems over a network, contains a critical security flaw. An unauthorized attacker could exploit this vulnerability to remotely run malicious code on the server. This could lead to a complete takeover of the deployment server, potentially compromising the integrity of all operating system images sent to other computers in the organization.
Technical details
A use-after-free vulnerability (CWE-416) exists within Microsoft Windows Deployment Services (WDS). The flaw is triggered when the service improperly handles objects in memory during network communication, allowing an attacker to reuse a memory pointer after it has been freed. While the attack can be initiated over the network without authentication, the CVSS complexity is rated as high, suggesting specific timing or environmental conditions are required for successful exploitation. Successful exploitation grants the attacker remote code execution (RCE) capabilities on the affected server. Microsoft has released security updates to address this issue.
Affected products
- Microsoft Windows Deployment Services
Timeline
- 2026-06-09: disclosed
- 2026-06-09: advisory: Microsoft published the security update guide for this vulnerability.