Description
Out-of-bounds read in Windows Network File System allows an authorized attacker to deny service over a network.
Published: 2026-09-08
Score: 5.7 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service via network
Action: Patch immediately
AI Analysis

Impact

The vulnerability is an out‑of‑bounds read in the Windows Network File System layer that allows an authenticated attacker to trigger a denial of service by causing the system to crash or become unresponsive over the network.

Affected Systems

Microsoft Windows 10 (1607 and 1809) and Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including both full and Server Core installations are affected.

Risk and Exploitability

The CVSS score of 5.7 indicates a moderate severity, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is not available, so the exact likelihood of exploitation is unknown. Based on the description, it is inferred that an attacker would need to exploit the SMB protocol to trigger the out‑of‑bounds read and cause a service interruption. Because it only leads to service denial and not data compromise, the overall risk is moderate but the outage can have significant impact on business availability.

Generated by OpenCVE AI on September 8, 2026 at 22:12 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Download and install the Microsoft security update that fixes the out‑of‑bounds read in Windows Network File System.
  • Configure Windows Update or WSUS to automatically push the update to all affected Windows 10 and Server installations, including Server Core editions, to ensure timely deployment.
  • Monitor system and SMB logs for repeated service crashes or restarts after deployment to detect any residual exploitation attempts.

Generated by OpenCVE AI on September 8, 2026 at 22:12 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 17 Sep 2026 16:00:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*

Thu, 10 Sep 2026 21:30:00 +0000

Type Values Removed Values Added
First Time appeared Microsoft windows Server 2012 (server Core Installation)
Microsoft windows Server 2012 R2
Microsoft windows Server 2012 R2 (server Core Installation)
Microsoft windows Server 2016 (server Core Installation)
Microsoft windows Server 2019 (server Core Installation)
Microsoft windows Server 2025 (server Core Installation)
Vendors & Products Microsoft windows Server 2012 (server Core Installation)
Microsoft windows Server 2012 R2
Microsoft windows Server 2012 R2 (server Core Installation)
Microsoft windows Server 2016 (server Core Installation)
Microsoft windows Server 2019 (server Core Installation)
Microsoft windows Server 2025 (server Core Installation)

Tue, 08 Sep 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 08 Sep 2026 17:30:00 +0000

Type Values Removed Values Added
Description Out-of-bounds read in Windows Network File System allows an authorized attacker to deny service over a network.
Title Windows Network File System Denial of Service Vulnerability
First Time appeared Microsoft
Microsoft windows 10 1607
Microsoft windows 10 1809
Microsoft windows Server 2012
Microsoft windows Server 2012 R2
Microsoft windows Server 2016
Microsoft windows Server 2019
Microsoft windows Server 2022
Microsoft windows Server 2025
Weaknesses CWE-125
CPEs cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_server_2012:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_server_2012_R2:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*
Vendors & Products Microsoft
Microsoft windows 10 1607
Microsoft windows 10 1809
Microsoft windows Server 2012
Microsoft windows Server 2012 R2
Microsoft windows Server 2016
Microsoft windows Server 2019
Microsoft windows Server 2022
Microsoft windows Server 2025
References
Metrics cvssV3_1

{'score': 5.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C'}

Subscriptions

Microsoft Windows 10 1607 Windows 10 1809 Windows Server 2012 Windows Server 2012 (server Core Installation) Windows Server 2012 R2 Windows Server 2012 R2 Windows Server 2012 R2 (server Core Installation) Windows Server 2016 Windows Server 2016 (server Core Installation) Windows Server 2019 Windows Server 2019 (server Core Installation) Windows Server 2022 Windows Server 2025 Windows Server 2025 (server Core Installation)
cve-icon MITRE

Status: PUBLISHED

Assigner: microsoft

Published:

Updated: 2026-09-29T21:43:44.738Z

Reserved: 2026-08-03T20:54:04.486Z

Link: CVE-2026-69372

cve-icon Vulnrichment

Updated: 2026-09-08T20:49:19.947Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-08T18:18:57.580

Modified: 2026-09-24T23:17:43.087

Link: CVE-2026-69372

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-10T21:01:27Z

Weaknesses