Executive brief
A use-after-free vulnerability in Windows SMB Client allows an attacker to execute arbitrary code on a Windows system over the network without authentication. SMB Client is a core component used for file sharing and network access across Windows systems. Exploitation could lead to complete system compromise and lateral movement within an organization.
Technical details
A use-after-free vulnerability exists in the Windows SMB Client due to improper memory management when handling SMB protocol messages. The vulnerability is triggered over the network (SMB protocol, port 445) and requires no user interaction or prior authentication. An attacker can craft a malicious SMB message to trigger the use-after-free condition, leading to arbitrary code execution with the privileges of the SMB Client service. The vulnerability has a CVSS v3.1 score of 8.1 and is not currently known to be exploited in the wild.
Affected products
- Microsoft Windows SMB Client
Timeline
- 2026-09-08: disclosed