CVE-2026-42987 Overview
CVE-2026-42987 is a use-after-free vulnerability [CWE-416] in Windows Deployment Services (WDS) that allows an unauthenticated attacker to execute code remotely over a network. The flaw affects multiple supported versions of Windows Server, including Server 2012, 2016, 2019, 2022, and 2025. Exploitation does not require user interaction or prior authentication, but Microsoft rates the attack complexity as high. Successful exploitation impacts confidentiality, integrity, and availability of the target host.
Critical Impact
An unauthenticated remote attacker can execute arbitrary code in the context of the Windows Deployment Services process, potentially compromising provisioning infrastructure used to deploy operating systems across the enterprise.
Affected Products
- Microsoft Windows Server 2012 and 2012 R2
- Microsoft Windows Server 2016 and 2019
- Microsoft Windows Server 2022 and 2025
Discovery Timeline
- 2026-06-09 - CVE-2026-42987 published to NVD
- 2026-06-11 - Last updated in NVD database
Technical Details for CVE-2026-42987
Vulnerability Analysis
The vulnerability resides in Windows Deployment Services, a server role used to network-deploy Windows operating systems through Preboot Execution Environment (PXE) and Trivial File Transfer Protocol (TFTP). A use-after-free condition occurs when the WDS service references memory that has already been released. An attacker who triggers the dangling pointer can manipulate the freed allocation to redirect execution flow.
Because WDS exposes network listeners to facilitate boot and image transfer operations, the attack surface is reachable without authentication. Microsoft assigns a high attack complexity, indicating the attacker must win a race condition or shape heap state to achieve reliable code execution. The EPSS probability is 0.086% as of 2026-06-11.
Root Cause
The root cause is improper object lifetime management within the WDS service. A code path frees a memory object while another reference to that object remains active. Subsequent operations dereference the stale pointer, enabling memory corruption that an attacker can shape into arbitrary code execution.
Attack Vector
The attack vector is network-based. An unauthenticated attacker with reachability to a WDS server can send crafted protocol messages to the affected service. The interaction sequence must trigger the free and subsequent reuse of the object, achieving code execution in the security context of the WDS service.
No verified public proof-of-concept code is available. See the Microsoft Security Update Guide for CVE-2026-42987 for additional technical context.
Detection Methods for CVE-2026-42987
Indicators of Compromise
- Unexpected crashes or restarts of the WDSServer service on Windows Server hosts running the Deployment Services role.
- Anomalous inbound network traffic to WDS listening ports, including TFTP (UDP/69) and the WDS multicast and control channels.
- New child processes spawned by wdsserver.exe that do not match documented deployment workflows.
Detection Strategies
- Monitor Windows Event Logs for service crashes, application errors, and Windows Error Reporting entries referencing WDS components.
- Correlate PXE and TFTP request patterns with source IP reputation and known deployment scopes to flag rogue clients.
- Hunt for post-exploitation behaviors such as credential dumping, lateral movement, or persistence originating from WDS hosts.
Monitoring Recommendations
- Enable verbose logging on WDS servers and forward logs to a centralized analytics platform for correlation.
- Baseline normal deployment traffic volumes and alert on deviations outside imaging windows.
- Track service availability metrics for WDSServer to identify repeated unexpected terminations indicative of exploitation attempts.
How to Mitigate CVE-2026-42987
Immediate Actions Required
- Apply the Microsoft security update referenced in the Microsoft Security Update Guide for CVE-2026-42987 to all affected Windows Server systems.
- Inventory servers running the Windows Deployment Services role and prioritize patching internet-exposed or broadly reachable hosts.
- Restrict network reachability of WDS services to trusted provisioning VLANs using firewall rules and network segmentation.
Patch Information
Microsoft has published guidance and updates through the Microsoft Security Response Center. Refer to the Microsoft Vulnerability CVE-2026-42987 advisory for the specific update packages applicable to each Windows Server version. Apply the corresponding cumulative update for Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025.
Workarounds
- Disable the Windows Deployment Services role on servers where it is not actively used until patches are deployed.
- Block inbound TFTP (UDP/69) and PXE traffic at perimeter and internal firewalls except from authorized provisioning subnets.
- Require IPsec or network-level authentication for traffic destined to WDS hosts where supported by the environment.
# Temporarily stop and disable the WDS service on an unpatched host
sc.exe stop WDSServer
sc.exe config WDSServer start= disabled
# Restrict inbound TFTP traffic to a trusted provisioning subnet
New-NetFirewallRule -DisplayName "Block-WDS-TFTP" -Direction Inbound `
-Protocol UDP -LocalPort 69 -RemoteAddress "0.0.0.0/0" -Action Block
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
