CVE-2026-54997: Windows 10 1607 Information Disclosure

CVE-2026-54997 Overview

CVE-2026-54997 is an information disclosure vulnerability in the Windows Server Message Block (SMB) component. The flaw stems from the use of an uninitialized resource [CWE-908], which allows an authorized local attacker to read memory contents that should remain protected. Microsoft has confirmed the vulnerability affects a broad range of Windows client and server operating systems, from Windows 10 1607 through Windows Server 2025.

Exploitation requires local access and low privileges, but no user interaction. Successful exploitation exposes sensitive kernel or driver memory contents that may aid further attacks against the host.

Critical Impact
A low-privileged local attacker can read uninitialized memory through the SMB component, potentially disclosing sensitive data such as credentials, cryptographic material, or kernel address information usable in subsequent privilege escalation chains.

Affected Products

Microsoft Windows 10 (versions 1607, 1809, 21H2, 22H2)
Microsoft Windows 11 (versions 24H2, 25H2, 26H1)
Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025

Discovery Timeline

2026-07-14 - CVE-2026-54997 published to the National Vulnerability Database
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-54997

Vulnerability Analysis

The vulnerability resides in the Windows SMB implementation, which handles file and resource sharing across networks. SMB allocates memory structures to process client requests and manage protocol state. In this defect, the SMB code path uses a resource before initializing it, causing residual memory contents to be exposed to the requesting caller.

Use of an uninitialized resource [CWE-908] typically returns stale data left over from prior allocations. That data may include pointers, handles, session tokens, or fragments of processed SMB traffic. Because the attack vector is local, the attacker must already have a foothold on the machine with at least standard user privileges.

The vulnerability does not grant code execution or modification capabilities. Confidentiality is the only impacted security property, but the disclosed data can be leveraged to bypass Kernel Address Space Layout Randomization (KASLR) or to obtain material useful in chained exploitation.

Root Cause

The defect originates from an SMB code path that reads from a memory buffer or resource handle without an intervening initialization step. When the SMB service processes certain requests, the uninitialized region is copied into a response or exposed to a caller, leaking whatever data remained in that memory from prior use.

Attack Vector

An authenticated local user issues crafted SMB requests to the local SMB service. The requests trigger the vulnerable code path, causing the service to return uninitialized memory in its response. The attacker parses the returned bytes to extract sensitive data.

No verified proof-of-concept code has been published, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the Microsoft Security Update Guide for CVE-2026-54997 for vendor-supplied technical details.

Detection Methods for CVE-2026-54997

Indicators of Compromise

Unexpected local SMB traffic originating from standard user processes that do not typically interact with \\.\pipe\ or loopback SMB endpoints.
Repeated or malformed SMB requests targeting the local SMB service (srv2.sys, srvnet.sys) from non-administrative accounts.
Process creation events showing unusual tooling issuing SMB client API calls from user sessions.

Detection Strategies

Monitor Windows Security event logs for anomalous SMB session creation events (Event IDs 5140, 5145) sourced from local, non-service accounts.
Correlate SMB client activity with process ancestry to identify low-privileged binaries probing the local SMB stack.
Baseline normal SMB usage per host and alert on statistically rare local SMB request patterns.

Monitoring Recommendations

Enable SMB auditing via Audit-SmbShareAccess and forward events to a centralized log platform.
Track outbound data flows from user-mode processes that follow SMB request bursts to detect exfiltration of leaked memory contents.
Review scheduled tasks and services that could invoke SMB in unexpected contexts.

How to Mitigate CVE-2026-54997

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-54997 across all affected Windows client and server systems.
Prioritize patching on multi-user systems, terminal servers, and hosts where non-administrative users execute untrusted workloads.
Audit local account inventories and remove unnecessary standard user access on sensitive hosts.

Patch Information

Microsoft has issued cumulative updates addressing CVE-2026-54997 for all listed Windows 10, Windows 11, and Windows Server versions. Administrators should consult the Microsoft Security Update Guide to identify the correct KB article for each build and deploy the update through Windows Update, WSUS, Intune, or Configuration Manager.

Workarounds

Restrict local logon rights to trusted administrative users where operationally feasible until patches are deployed.
Disable SMB features not required on the host, and enforce least-privilege on accounts that can interact with SMB services.
Apply application control policies such as Windows Defender Application Control (WDAC) to limit which binaries can issue SMB client requests from user contexts.

bash

# Verify installed updates and SMB configuration on a Windows host
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 20
Get-SmbServerConfiguration | Select-Object EnableSMB1Protocol, EnableSMB2Protocol, AuditSmb1Access
AuditPol /get /subcategory:"File Share"