CVE-2026-49172: Windows 10 1607 Buffer Overflow Flaw

CVE-2026-49172 Overview

CVE-2026-49172 is a heap-based buffer overflow [CWE-122] in the Windows FTP Service. An unauthenticated remote attacker can send crafted FTP protocol traffic to trigger memory corruption and execute arbitrary code on the target host. The flaw affects a broad range of Windows client and server releases, including Windows 10, Windows 11, and Windows Server 2019 through Windows Server 2025. Because exploitation requires no privileges and no user interaction, any Windows system exposing the FTP Service to reachable networks is at direct risk of remote code execution.

Critical Impact
Unauthenticated attackers can achieve remote code execution against Windows FTP Service, resulting in full compromise of confidentiality, integrity, and availability on affected hosts.

Affected Products

Microsoft Windows 10 (versions 1607, 1809, 21H2, 22H2) across x86, x64, and ARM64
Microsoft Windows 11 (versions 23H2, 24H2, 25H2, 26H1) across x64 and ARM64
Microsoft Windows Server 2019, Windows Server 2022, and Windows Server 2025

Discovery Timeline

2026-07-14 - CVE-2026-49172 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-49172

Vulnerability Analysis

The vulnerability resides in the Windows FTP Service, a component that processes File Transfer Protocol commands and data streams over the network. Improper validation of attacker-controlled input during FTP request handling causes the service to write beyond an allocated heap buffer.

Because the FTP protocol accepts commands prior to authentication, an attacker can reach the vulnerable code path without credentials. Successful exploitation corrupts heap metadata or adjacent objects, giving the attacker control over process execution flow. Code executes in the security context of the FTP Service, which typically runs with elevated privileges on Windows Server hosts.

Root Cause

The root cause is a heap-based buffer overflow [CWE-122] in the FTP protocol parsing logic. The service allocates a fixed-size heap buffer and copies attacker-supplied data without correctly bounding the write against the destination size. Crafted FTP commands or arguments exceeding the expected length overflow the buffer and overwrite adjacent heap structures.

Attack Vector

Exploitation occurs over the network with no authentication and no user interaction. The attacker establishes a TCP connection to the FTP Service (typically port 21) and issues malformed FTP commands designed to trigger the overflow. Internet-exposed Windows Server hosts running the FTP role are the primary targets, but internal segments where the service is enabled are also reachable via lateral movement.

No verified public exploit code is available at the time of publication. Refer to the Microsoft CVE-2026-49172 Update Guide for authoritative technical details.

Detection Methods for CVE-2026-49172

Indicators of Compromise

Unexpected crashes or restarts of the ftpsvc service or the hosting svchost.exe process, particularly with heap corruption exceptions in Windows Error Reporting logs.
Anomalous child processes spawned by the FTP Service, such as cmd.exe, powershell.exe, or rundll32.exe, indicating post-exploitation activity.
Inbound TCP connections to port 21 from unusual geolocations followed by outbound command-and-control traffic from the FTP host.

Detection Strategies

Monitor Windows Event Logs for Application Error events (Event ID 1000) referencing FTP service binaries and heap corruption fault codes.
Alert on FTP command sequences containing excessively long arguments to commands such as USER, PASS, CWD, or SITE that exceed normal protocol boundaries.
Correlate FTP session establishment with subsequent process creation events on the same host to detect exploitation chains.

Monitoring Recommendations

Enable Sysmon Event ID 1 (process creation) and Event ID 3 (network connection) on all servers running the FTP role, and forward logs to a centralized SIEM.
Deploy network intrusion detection signatures for oversized FTP command payloads and known heap grooming patterns targeting Windows FTP services.
Track authentication failures and pre-authentication command volume on FTP endpoints to identify reconnaissance and exploitation attempts.

How to Mitigate CVE-2026-49172

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft CVE-2026-49172 Update Guide to all affected Windows 10, Windows 11, and Windows Server systems.
Inventory hosts running the Microsoft FTP Service and prioritize patching internet-facing systems first.
Restrict inbound TCP port 21 access at perimeter firewalls to trusted source addresses until patches are deployed.

Patch Information

Microsoft has published guidance and security updates through the Microsoft CVE-2026-49172 Update Guide. Administrators should consult the vendor advisory to obtain the correct update package for each affected Windows build and architecture, including x86, x64, and ARM64 variants.

Workarounds

Disable the Microsoft FTP Service on hosts where FTP is not required by stopping and disabling the ftpsvc service.
Replace FTP with secure alternatives such as SFTP or FTPS on dedicated, hardened servers to eliminate exposure of the vulnerable component.
Enforce network segmentation and host-based firewall rules to limit reachability of port 21 to specific administrative hosts only.

bash

# Stop and disable the Windows FTP Service via PowerShell
Stop-Service -Name ftpsvc -Force
Set-Service -Name ftpsvc -StartupType Disabled

# Block inbound FTP at the host firewall as a defense-in-depth measure
New-NetFirewallRule -DisplayName "Block Inbound FTP (CVE-2026-49172)" `
  -Direction Inbound -Protocol TCP -LocalPort 21 -Action Block