CVE-2026-44805: Windows NC Host Agent Use After Free Flaw

CVE-2026-44805 Overview

CVE-2026-44805 is a use-after-free vulnerability [CWE-416] in the Windows Network Controller (NC) Host Agent. An authorized local attacker can trigger the flaw to cause a denial of service on the affected host. The vulnerability requires local access and low privileges, with no user interaction needed. Successful exploitation impacts availability only, with no confidentiality or integrity exposure.

Microsoft published guidance for this issue through the Microsoft Security Response Center. The affected component runs on Windows Server systems acting as Software Defined Networking (SDN) hosts managed by Network Controller.

Critical Impact
An authorized local attacker can crash the Network Controller Host Agent, disrupting SDN management traffic and degrading availability of virtualized network services on affected Windows Server hosts.

Affected Products

Microsoft Windows Server (Network Controller Host Agent component)
Windows Software Defined Networking (SDN) deployments
Refer to the Microsoft Security Update Guide for the exhaustive product and build list

Discovery Timeline

2026-06-09 - CVE CVE-2026-44805 published to NVD
2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-44805

Vulnerability Analysis

The Network Controller (NC) Host Agent is the Windows Server service that communicates with the SDN Network Controller to program virtual network policies on Hyper-V hosts. The flaw is a use-after-free condition [CWE-416] in the Host Agent process. A locally authenticated attacker can interact with the agent in a way that causes it to reference memory that has already been released.

When the freed memory is reused or overwritten, dereferencing the stale pointer produces undefined behavior. In this case, it crashes the Host Agent process, resulting in a denial of service for SDN management on the host. The attack does not yield code execution because the impact is limited to availability, with confidentiality and integrity unaffected.

Root Cause

The root cause is improper lifetime management of an object inside the Network Controller Host Agent. The code paths that handle agent operations release a memory allocation while another execution path retains a reference to it. Subsequent access to that reference dereferences freed memory and terminates the service.

Attack Vector

Exploitation requires local access to an affected Windows Server host and a valid low-privileged account. The attacker issues crafted requests or operations against the Network Controller Host Agent to trigger the unsafe object reuse. No user interaction is required, and the scope remains unchanged. No public proof-of-concept code is available, and the EPSS forecast indicates a low probability of near-term exploitation.

No verified exploit code is published. See the Microsoft Security Update Guide for technical details.

Detection Methods for CVE-2026-44805

Indicators of Compromise

Unexpected termination or repeated restarts of the Network Controller Host Agent service (NcHostAgent) on Windows Server SDN hosts
Windows Error Reporting or Application event log entries showing access violation crashes in the Host Agent process
Loss of SDN policy synchronization between Hyper-V hosts and the Network Controller

Detection Strategies

Monitor the Windows Service Control Manager for stop and start events for NcHostAgent on managed SDN hosts
Alert on Event ID 1000 and 1001 entries in the Application log referencing the Network Controller Host Agent binary
Correlate Host Agent crashes with the originating local user session to identify the actor triggering the fault

Monitoring Recommendations

Forward Windows Application, System, and Security logs from SDN hosts to a centralized analytics platform for crash and authentication correlation
Track service health metrics for the Network Controller Host Agent and alert on availability dips
Audit interactive and remote logons to Hyper-V hosts running the Host Agent, with focus on non-administrative accounts

How to Mitigate CVE-2026-44805

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide on all Windows Server hosts running the Network Controller Host Agent
Restrict interactive and remote logon rights on SDN hosts to administrative personnel only
Review accounts with local logon access to Hyper-V hosts and remove unnecessary privileges

Patch Information

Microsoft addresses CVE-2026-44805 through the cumulative security update published in the Microsoft Security Update Guide. Administrators should install the update on every Windows Server host that runs the Network Controller Host Agent, then verify the NcHostAgent service starts cleanly after reboot.

Workarounds

No vendor-supplied workaround is documented; patching is the supported remediation path
Limit local logon rights on SDN hosts to reduce the set of accounts that can trigger the flaw
Increase monitoring on Network Controller Host Agent service state until the patch is deployed across the fleet

bash

# Verify the Network Controller Host Agent service state on a Windows Server SDN host
Get-Service -Name NcHostAgent

# Confirm installed updates include the Microsoft fix referenced in the advisory
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 20