CVE-2026-44806: Windows 10 1607 DOS Vulnerability

CVE-2026-44806 Overview

CVE-2026-44806 is a denial-of-service vulnerability in Windows Cryptographic Services caused by missing release of memory after effective lifetime [CWE-401]. An unauthenticated remote attacker can exhaust memory resources by sending crafted requests over the network, degrading availability of the affected service. The flaw affects a broad range of Microsoft Windows client and server operating systems, from Windows 10 1607 through Windows 11 26H1 and from Windows Server 2012 through Windows Server 2025. Microsoft published guidance for this issue in its security update guide.

Critical Impact
Unauthenticated network attackers can trigger a memory leak in Windows Cryptographic Services to cause a denial-of-service condition on affected Windows and Windows Server systems.

Affected Products

Microsoft Windows 10 (1607, 1809, 21H2, 22H2) and Windows 11 (24H2, 25H2, 26H1)
Microsoft Windows Server 2012, 2012 R2, 2016, 2019
Microsoft Windows Server 2022 and Windows Server 2025

Discovery Timeline

2026-07-14 - CVE-2026-44806 published to NVD
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-44806

Vulnerability Analysis

The vulnerability resides in Windows Cryptographic Services, a core component that provides key management, certificate validation, and cryptographic primitives to applications and system services. Cryptographic Services fails to release memory allocated during request processing after that memory is no longer needed. Repeated network-reachable operations therefore accumulate unreleased allocations in the service process.

As allocations grow, memory pressure increases on the host. Legitimate cryptographic operations begin to fail, dependent services degrade, and the system can become unresponsive. Because Cryptographic Services underpins authentication, code signing checks, and TLS operations, downstream impact extends beyond the service itself.

The issue is classified as a Missing Release of Memory after Effective Lifetime weakness [CWE-401]. It requires no authentication, no user interaction, and can be triggered over a network path.

Root Cause

The root cause is an object lifecycle defect in Cryptographic Services. A code path that processes attacker-influenced input allocates memory but does not free it on all exit paths. Each triggering request incrementally consumes non-paged or heap memory belonging to the service process, producing a cumulative leak.

Attack Vector

An attacker sends repeated crafted requests to a network endpoint served by Windows Cryptographic Services on a vulnerable host. No credentials are required. Sustained request volume drives memory consumption until the service or the operating system exhausts available memory and enters a denial-of-service state. Recovery typically requires restarting the service or the host.

No public proof-of-concept exploit is currently listed for this CVE, and it is not on the CISA Known Exploited Vulnerabilities catalog at the time of publication.

Detection Methods for CVE-2026-44806

Indicators of Compromise

Sustained growth in memory usage of the CryptSvc service or its host svchost.exe process without a corresponding increase in legitimate workload.
Repeated failures of TLS handshakes, certificate chain validations, or authentication events on the affected host.
Event log entries indicating Cryptographic Services restarts, hangs, or out-of-memory conditions.

Detection Strategies

Baseline memory consumption for CryptSvc across the fleet and alert on statistical deviations sustained over time.
Correlate spikes in inbound network requests to services that rely on Cryptographic Services with subsequent memory growth or service errors.
Monitor Windows Service Control Manager events for unexpected restarts of Cryptographic Services.

Monitoring Recommendations

Ingest Windows performance counters for process working set and private bytes into a central telemetry pipeline for trending.
Alert on repeated failures of dependent services such as Schannel, WinHTTP, and certificate enrollment.
Track edge and host firewall logs for anomalous connection volume from single or distributed sources to Windows hosts exposing cryptographic endpoints.

How to Mitigate CVE-2026-44806

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide for CVE-2026-44806 as soon as testing permits.
Prioritize patching of internet-exposed Windows servers and any host providing authentication, certificate, or TLS services.
Inventory affected Windows and Windows Server versions listed above to confirm patch coverage.

Patch Information

Microsoft has published guidance and updates for CVE-2026-44806 through the Microsoft Security Response Center. Refer to the Microsoft Security Update Guide for the specific KB articles, build numbers, and applicability per Windows release. Deploy the updates via Windows Update, WSUS, Microsoft Intune, or Configuration Manager depending on the environment.

Workarounds

Restrict network exposure of Windows hosts by limiting inbound access to trusted networks using host and perimeter firewalls until patches are deployed.
Rate-limit inbound connections at network intermediaries to reduce the ability of an attacker to accelerate memory exhaustion.
Configure service recovery options to automatically restart Cryptographic Services on failure as a temporary resilience measure, understanding this does not remediate the flaw.

bash

# Configuration example: restrict inbound access and configure service recovery
# Restrict inbound traffic to trusted management subnet (example)
New-NetFirewallRule -DisplayName "Restrict CryptSvc Inbound" -Direction Inbound -Action Block -RemoteAddress Any
New-NetFirewallRule -DisplayName "Allow CryptSvc Trusted" -Direction Inbound -Action Allow -RemoteAddress 10.0.0.0/24

# Configure Cryptographic Services to auto-restart on failure
sc.exe failure CryptSvc reset= 86400 actions= restart/60000/restart/60000/restart/60000