CVE-2026-72954 in Windows
Summary
by MITRE • 09/09/2026
Use after free in Windows Deployment Services allows an authorized attacker to execute code over a network.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/09/2026
Windows Deployment Services contains a critical use-after-free vulnerability that stems from improper handling of memory deallocation within the service's core processing logic. This flaw occurs when the system releases a pointer to a block of memory but fails to nullify it, allowing subsequent operations to access and manipulate that freed memory region. In the context of Windows Deployment Services, which is responsible for network-based installation of operating systems, this vulnerability presents a severe risk because the service processes complex data structures received from remote clients during deployment tasks. An attacker who has valid authentication credentials on the target system can exploit this timing gap to inject malicious payloads into the freed memory space before it is reallocated or garbage collected by the operating system's memory manager.
The operational impact of this vulnerability is significant, as successful exploitation allows an authenticated attacker to achieve arbitrary code execution with the privileges of the Windows Deployment Services process. Since these services typically run under high-privilege accounts such as SYSTEM or local administrators, gaining control over them provides a comprehensive foothold within the network infrastructure. This capability enables lateral movement, data exfiltration, and complete compromise of the affected server. The vulnerability is particularly dangerous in enterprise environments where deployment servers are often exposed to internal networks containing multiple client machines that may be compromised by other threats or malicious insiders.
From a classification perspective, this flaw aligns with CWE-416, which describes use-after-free conditions resulting from incorrect memory management practices. In terms of offensive security frameworks, the exploitation vector corresponds to MITRE ATT&CK technique T1203, specifically the execution phase where attackers leverage software vulnerabilities to run malicious code on target systems. The network-based nature of Windows Deployment Services means that while authentication is required, the attack surface remains broad across any machine capable of initiating a deployment request against the vulnerable server.
Mitigation strategies must focus on both immediate remediation and long-term architectural improvements. Organizations should immediately apply vendor-provided security patches to update the underlying libraries handling memory allocation in Windows Deployment Services. Access control lists should be strictly configured to limit which users or groups can initiate deployment tasks, ensuring that only trusted administrative accounts have permission to interact with the service. Additionally, network segmentation should be employed to isolate deployment servers from general user workstations and untrusted subnets. Monitoring tools should be tuned to detect anomalous memory access patterns or unexpected process executions originating from Windows Deployment Services processes, providing an early warning system for potential exploitation attempts in real-time.