CVE-2026-59138: Windows 10 1607 DOS Vulnerability

CVE-2026-59138 Overview

CVE-2026-59138 is a null pointer dereference vulnerability [CWE-476] in the Microsoft Remote Registry Service. An authenticated attacker can send crafted requests over the network to trigger the flaw and cause a denial of service condition on the affected host. The vulnerability affects a broad range of Microsoft Windows client and server platforms, from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Windows Server 2025.

Microsoft published the advisory through the Microsoft Security Response Center (MSRC) update guide. No public exploit code has been observed, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Critical Impact
A low-privileged, authenticated network attacker can crash the Remote Registry Service and disrupt registry-dependent administrative operations across Windows endpoints and servers.

Affected Products

Microsoft Windows 10 (1607, 1809, 21H2, 22H2)
Microsoft Windows 11 (23H2, 24H2, 25H2, 26H1)
Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025

Discovery Timeline

2026-08-11 - CVE-2026-59138 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-59138

Vulnerability Analysis

The Remote Registry Service (RemoteRegistry) exposes the Windows registry to authenticated remote users through the Windows Registry Remote Protocol (MS-RRP) over Server Message Block (SMB) named pipes. The service dereferences a pointer that has not been validated for null before use, which causes the hosting svchost.exe process to terminate abnormally when the flaw is triggered.

Exploitation results in loss of availability for the Remote Registry Service. Administrative tooling and monitoring agents that depend on remote registry access will fail until the service restarts. The impact is limited to availability; the flaw does not expose registry contents or allow modification.

The attack requires network reachability to the target and a set of valid low-privilege credentials. Complexity is low, and no user interaction is required to invoke the vulnerable code path.

Root Cause

The root cause is a missing null check on a pointer used within the Remote Registry Service RPC handler. When the service processes a specific request pattern from a client, the code path reaches a dereference operation without verifying that the pointer references a valid object, triggering an access violation.

Attack Vector

Exploitation requires an authenticated session to the target over SMB, typically on TCP port 445, and access to the \PIPE\winreg named pipe exposed by the Remote Registry Service. The attacker issues a malformed or unexpected MS-RRP request that steers the service into the vulnerable code path. Because privileges required are low, any domain user with network connectivity to a system running the Remote Registry Service can trigger the crash.

See the Microsoft Security Update CVE-2026-59138 advisory for vendor-authored technical details.

Detection Methods for CVE-2026-59138

Indicators of Compromise

Unexpected termination of the svchost.exe instance hosting the RemoteRegistry service, accompanied by Windows Error Reporting or Application Error events referencing an access violation (0xC0000005).
Service Control Manager events (Event ID 7031 or 7034) indicating the Remote Registry Service terminated unexpectedly.
Anomalous inbound SMB traffic to TCP port 445 followed by connections to the \PIPE\winreg named pipe from non-administrative accounts.

Detection Strategies

Correlate authentication events (Event ID 4624 with logon type 3) with subsequent Remote Registry Service crashes to identify the responsible account and source host.
Monitor for repeated Remote Registry Service failures across multiple systems, which may indicate scripted abuse against an environment.
Alert on named pipe connections to \winreg originating from user accounts that do not have a business need for remote registry access.

Monitoring Recommendations

Ingest Windows System, Application, and Security event logs into a centralized SIEM to detect service crash patterns tied to specific source IPs.
Enable SMB session auditing on Windows Server systems to record which principals open the winreg pipe.
Track the run state of the RemoteRegistry service on servers where it is intentionally enabled and alert when the state transitions to stopped outside of change windows.

How to Mitigate CVE-2026-59138

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-59138 to all affected Windows client and server systems.
Inventory systems where the Remote Registry Service is running and disable it on hosts that do not require remote registry access.
Restrict inbound SMB (TCP 445) to trusted management networks using host and perimeter firewalls.

Patch Information

Microsoft has released updates addressing CVE-2026-59138 across supported versions of Windows 10, Windows 11, and Windows Server. Refer to the Microsoft Security Update CVE-2026-59138 guidance for the specific KB article and build numbers that apply to each affected release.

Workarounds

Set the RemoteRegistry service startup type to Disabled on systems that do not require remote registry access, then stop the running service.
Use Windows Defender Firewall or Group Policy to block inbound access to the \PIPE\winreg named pipe from untrusted subnets.
Enforce SMB signing and require authenticated sessions from management jump hosts only, reducing the pool of accounts capable of reaching the vulnerable RPC interface.

bash

# Disable the Remote Registry Service on a Windows host (run as administrator)
sc.exe config RemoteRegistry start= disabled
sc.exe stop RemoteRegistry