Executive brief
A critical security vulnerability has been identified in the Windows component responsible for file sharing and network printing (SMB). An attacker could exploit this flaw to remotely execute malicious code on a target system, potentially leading to a full system takeover or data theft. While the attack is complex and requires some user interaction, it poses a significant risk to corporate environments where file sharing is enabled.
Technical details
This vulnerability is classified as a Use-After-Free (CWE-416) within the Windows SMB Server Network Transport Driver (srvnet.sys). The flaw exists in how the driver manages memory during network transport operations. An unauthenticated attacker can exploit this over the network, though the CVSS vector indicates high attack complexity and a requirement for user interaction. Successful exploitation could lead to remote code execution (RCE) with kernel-level privileges. Microsoft has released security updates to address this issue across affected Windows 10, 11, and Server 2012 versions.
Affected products
- Microsoft Windows 10 Versions 1607, 1809, 21H2, 22H2
- Microsoft Windows 11 Versions 24H2, 25H2, 26H1
- Microsoft Windows Server 2012 All editions including Server Core
Timeline
- 2026-07-14: disclosed
- 2026-07-14: advisory