Description
Double free in Windows Internet Information Services allows an unauthorized attacker to deny service over a network.
Published: 2026-10-13
Score: 7.5 High
EPSS: 1.1% Low
KEV: No
Impact: Denial of Service
Action: Patch
AI Analysis

Impact

This vulnerability is a double free in Windows Internet Information Services that permits an unauthorized attacker to disrupt service. The flaw causes the IIS worker process to terminate unexpectedly, resulting in a denial of service. It involves improper memory management and is classified as CWE-415, affecting availability only without leaking confidential data or altering integrity.

Affected Systems

Affected systems include Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1 and Windows Server 2022 and Server 2025, including Server Core installations. Any installation that runs IIS is susceptible.

Risk and Exploitability

The CVSS score of 7.5 indicates a high severity, while the EPSS score is not available, so exploitation probability cannot be quantified at the moment. The vulnerability is not listed in CISA KEV, implying no known large‑scale exploitation. The likely attack vector is over the network, with an attacker needing only to send a crafted request to IIS. The impact is limited to availability, disabling legitimate traffic without providing further access.

Generated by OpenCVE AI on October 14, 2026 at 13:00 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Install the latest Windows Update that addresses CVE-2026-97830 and any other IIS related patches
  • If the update is not yet available, disable or uninstall IIS on systems that do not require it
  • Restrict inbound traffic to IIS by configuring firewall rules to allow only trusted IP addresses
  • Monitor IIS logs for service interruptions and restore service promptly if downtime occurs

Generated by OpenCVE AI on October 14, 2026 at 13:00 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 20 Oct 2026 12:45:00 +0000

Type Values Removed Values Added
First Time appeared Microsoft windows Server 2025 (server Core Installation)
Vendors & Products Microsoft windows Server 2025 (server Core Installation)

Fri, 16 Oct 2026 01:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 14 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
First Time appeared Microsoft windows 11 23h2
Microsoft windows 11 24h2
Microsoft windows 11 25h2
Microsoft windows 11 26h1
Microsoft windows 11 26h2
CPEs cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_11_25h2:*:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_11_25h2:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_11_26h1:*:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_11_26h1:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_11_26h2:*:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_11_26h2:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:x64:*
Vendors & Products Microsoft windows 11 23h2
Microsoft windows 11 24h2
Microsoft windows 11 25h2
Microsoft windows 11 26h1
Microsoft windows 11 26h2

Tue, 13 Oct 2026 19:15:00 +0000

Type Values Removed Values Added
Description Double free in Windows Internet Information Services allows an unauthorized attacker to deny service over a network.
Title Windows Internet Information Services Denial of Service Vulnerability
First Time appeared Microsoft
Microsoft windows 11 23h2
Microsoft windows 11 24h2
Microsoft windows 11 25h2
Microsoft windows 11 26h1
Microsoft windows 11 Version 26h2 For Arm64-based Systems
Microsoft windows Server 2022
Microsoft windows Server 2025
Weaknesses CWE-415
CPEs cpe:2.3:a:microsoft:windows_11_version_26h2_for_arm64-based_systems:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_11_23H2:*:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_11_23H2:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_11_24H2:*:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_11_25H2:*:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_11_26H1:*:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*
Vendors & Products Microsoft
Microsoft windows 11 23h2
Microsoft windows 11 24h2
Microsoft windows 11 25h2
Microsoft windows 11 26h1
Microsoft windows 11 Version 26h2 For Arm64-based Systems
Microsoft windows Server 2022
Microsoft windows Server 2025
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C'}

Subscriptions

Microsoft Windows 11 23h2 Windows 11 23h2 Windows 11 24h2 Windows 11 24h2 Windows 11 25h2 Windows 11 25h2 Windows 11 26h1 Windows 11 26h1 Windows 11 26h2 Windows 11 Version 26h2 For Arm64-based Systems Windows Server 2022 Windows Server 2025 Windows Server 2025 (server Core Installation)
cve-icon MITRE

Status: PUBLISHED

Assigner: microsoft

Published:

Updated: 2026-10-31T18:13:16.419Z

Reserved: 2026-09-25T04:47:50.226Z

Link: CVE-2026-97830

cve-icon Vulnrichment

Updated: 2026-10-13T22:11:49.519Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-13T19:22:22.557

Modified: 2026-10-14T20:19:55.197

Link: CVE-2026-97830

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-20T06:30:10Z

Weaknesses