CVE-2026-61345 Overview
CVE-2026-61345 is a null pointer dereference vulnerability [CWE-476] in the Microsoft Remote Registry Service. An authenticated attacker can send crafted requests over the network to trigger the dereference and crash the service, resulting in a denial of service condition on affected Windows systems.
The flaw affects a broad set of supported Windows client and server releases, including Windows 10, Windows 11, and Windows Server 2012 through 2025. Exploitation requires low privileges and no user interaction, but the impact is limited to availability.
Critical Impact
Authenticated network attackers can crash the Remote Registry Service on affected Windows hosts, disrupting remote administration and any tooling that depends on registry access.
Affected Products
- Microsoft Windows 10 (1607, 1809, 21H2, 22H2)
- Microsoft Windows 11 (23H2, 24H2, 25H2, 26H1)
- Microsoft Windows Server 2012, 2016, 2019, 2022, and 2025
Discovery Timeline
- 2026-08-11 - CVE-2026-61345 published to the National Vulnerability Database
- 2026-08-13 - Last updated in NVD database
Technical Details for CVE-2026-61345
Vulnerability Analysis
The vulnerability resides in the Microsoft Remote Registry Service, a Windows component that lets authorized users read and modify the registry on a remote machine. The service exposes registry operations over Remote Procedure Call (RPC) transports such as named pipes and TCP.
When the service processes a specific request from an authenticated client, it fails to validate a pointer before dereferencing it. Because the pointer can be NULL under attacker-controlled conditions, the read or write operation causes an access violation and terminates the service process.
The impact is limited to availability. Confidentiality and integrity are not affected, but the crash disrupts any remote registry access and can degrade centralized management, monitoring, and backup workflows that rely on the service. The EPSS score is 1.042% (61.01 percentile) as of 2026-08-13.
Root Cause
The root cause is a missing null check on a pointer used by the Remote Registry Service when handling a network-supplied request. The code path dereferences the pointer without verifying that a prior allocation or lookup succeeded, matching the [CWE-476] classification.
Attack Vector
An attacker must hold valid credentials on the target system or domain and be able to reach the Remote Registry Service over the network. After authenticating, the attacker sends a specifically crafted RPC request to the service to trigger the null dereference and crash the hosting process. No user interaction is required.
No public proof-of-concept exploit or in-the-wild exploitation has been reported. Refer to the Microsoft Vulnerability Advisory CVE-2026-61345 for vendor technical details.
Detection Methods for CVE-2026-61345
Indicators of Compromise
- Unexpected termination or repeated restarts of the RemoteRegistry service on Windows hosts.
- Windows Error Reporting or application crash events referencing the Remote Registry Service process.
- Authenticated RPC connections to the winreg named pipe followed immediately by service failure.
Detection Strategies
- Monitor the Windows Service Control Manager for stop or crash events on the RemoteRegistry service, especially when correlated with recent inbound authenticated sessions.
- Alert on anomalous volumes of winreg RPC traffic from non-administrative source hosts.
- Correlate authentication events (Event ID 4624 with logon type 3) with subsequent Remote Registry Service failures to identify the originating account.
Monitoring Recommendations
- Enable auditing of RPC and named pipe activity on domain controllers and management servers where the Remote Registry Service is exposed.
- Track service health metrics for RemoteRegistry and generate alerts on repeated unexpected stops.
- Review firewall and network flow logs for connections to TCP ports and SMB pipes used by remote registry access from unusual internal hosts.
How to Mitigate CVE-2026-61345
Immediate Actions Required
- Apply the Microsoft security update referenced in the Microsoft Vulnerability Advisory CVE-2026-61345 to all affected Windows client and server builds.
- Inventory systems where the Remote Registry Service is running and prioritize patching for domain controllers, management servers, and jump hosts.
- Restrict the accounts permitted to authenticate to affected systems to reduce the pool of potential attackers.
Patch Information
Microsoft has published the fix through its standard update channels. Consult the Microsoft Vulnerability Advisory CVE-2026-61345 for the specific KB articles and cumulative updates that correspond to each affected Windows version, and deploy them through Windows Update, WSUS, Intune, or Configuration Manager.
Workarounds
- Disable the Remote Registry Service (RemoteRegistry) on hosts that do not require remote registry access, and set its startup type to Disabled.
- Restrict inbound access to SMB and RPC endpoints used by the service to trusted management subnets using Windows Firewall or network ACLs.
- Enforce least privilege on accounts that can authenticate to affected systems to reduce the attack surface for authenticated denial-of-service attempts.
# Configuration example: disable the Remote Registry service on hosts that do not need it
sc.exe config RemoteRegistry start= disabled
sc.exe stop RemoteRegistry
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
