CVE-2026-40410 Overview
CVE-2026-40410 is a use-after-free vulnerability [CWE-416] in the Windows Server Message Block (SMB) Client. The flaw allows an authorized local attacker to elevate privileges on an affected system. Microsoft published the advisory on May 12, 2026, covering a broad set of Windows client and server releases.
Exploitation requires local access and low privileges, and the attack complexity is rated high. Successful exploitation impacts confidentiality, integrity, and availability. The vulnerability affects supported releases from Windows 10 1607 through Windows 11 26H1, and Windows Server 2012 R2 through Windows Server 2025.
Critical Impact
An authenticated local attacker can trigger a use-after-free condition in the SMB Client to gain elevated privileges on the host.
Affected Products
- Microsoft Windows 10 (1607, 1809, 21H2, 22H2) and Windows 11 (23H2, 24H2, 25H2, 26H1)
- Microsoft Windows Server 2012 R2, 2016, 2019, 2022, and 2022 23H2
- Microsoft Windows Server 2025
Discovery Timeline
- 2026-05-12 - CVE-2026-40410 published to NVD
- 2026-05-15 - Last updated in NVD database
Technical Details for CVE-2026-40410
Vulnerability Analysis
The vulnerability resides in the Windows SMB Client, which handles outbound SMB protocol communication for file, printer, and named-pipe access. A use-after-free condition occurs when the client references memory that has already been released. An authorized local attacker can manipulate the timing of object allocation and deallocation to reuse a dangling pointer.
When the freed object is reclaimed with attacker-controlled data, subsequent dereferences operate on corrupted kernel or process state. This can be steered toward arbitrary code execution at elevated privilege. The advisory classifies impact as high across confidentiality, integrity, and availability.
The high attack complexity reflects the need to win a race or otherwise reliably control allocator state. The EPSS estimate at publication is 0.04% (percentile 12.33), indicating no observed in-the-wild exploitation at this time.
Root Cause
The defect is a memory lifecycle error in SMB Client code paths. An object is freed while another reference still exists, and that reference is later dereferenced or written. The condition is tracked under CWE-416: Use After Free.
Attack Vector
The attack vector is local. An attacker must already be authenticated on the target system with low privileges. The attacker triggers SMB Client operations and races object cleanup to reuse freed memory and corrupt execution state. No user interaction is required.
No public proof-of-concept code or exploit modules are listed in the Microsoft Security Advisory CVE-2026-40410 at the time of publication.
Detection Methods for CVE-2026-40410
Indicators of Compromise
- Unexpected process crashes or bug checks referencing mrxsmb.sys, mrxsmb20.sys, or mup.sys on affected hosts.
- Local processes spawning SMB Client activity followed by privilege transitions to SYSTEM or service accounts.
- Anomalous loading of SMB client components by non-administrative user sessions.
Detection Strategies
- Monitor kernel-mode crash dumps and Windows Error Reporting events tied to SMB Client modules for repeated faults from the same low-privileged user.
- Correlate local SMB loopback or named-pipe activity with subsequent token elevation or new high-integrity process creation.
- Apply behavioral identification rules for local privilege escalation patterns, including unexpected parent-child process chains originating from standard user sessions.
Monitoring Recommendations
- Ingest Sysmon Event IDs 1, 10, and 11, plus Security Event IDs 4672 and 4688, to track process creation, handle access, and privilege assignment.
- Track patch state across affected Windows builds and alert on hosts missing the May 2026 cumulative update.
- Baseline normal SMB Client usage per host and alert on outliers from non-admin accounts.
How to Mitigate CVE-2026-40410
Immediate Actions Required
- Apply the May 2026 Microsoft security update referenced in the Microsoft Security Advisory CVE-2026-40410 to all affected Windows client and server builds.
- Prioritize patching of multi-user systems, jump hosts, and terminal servers where low-privileged users have interactive logon rights.
- Audit local account membership and remove unnecessary interactive logon permissions on servers.
Patch Information
Microsoft has released security updates for all listed builds, including Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 R2 through Windows Server 2025. Refer to the Microsoft Security Advisory CVE-2026-40410 for the specific KB article applicable to each build and architecture.
Workarounds
- No vendor-supplied workaround is documented; patching is the supported remediation path.
- Restrict interactive and remote desktop logon rights to trusted administrators where feasible to reduce the local attack surface.
- Enforce application allowlisting to limit which binaries unprivileged users can execute on sensitive hosts.
# Verify installed updates and SMB client driver version on Windows
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 10
Get-Item C:\Windows\System32\drivers\mrxsmb.sys | Select-Object Name, VersionInfo
Get-Item C:\Windows\System32\drivers\mrxsmb20.sys | Select-Object Name, VersionInfo
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
