CVE-2026-65794: Windows 10 1607 Information Disclosure Flaw

CVE-2026-65794 Overview

CVE-2026-65794 is a buffer over-read vulnerability in the Windows Server Message Block (SMB) Client that allows an unauthorized attacker to disclose information over a network. The flaw affects a broad range of Microsoft Windows client and server operating systems, including Windows 10, Windows 11, and Windows Server 2012 through 2025. Exploitation requires user interaction, such as convincing a user to connect to an attacker-controlled SMB server. Successful exploitation exposes sensitive process memory contents to the remote attacker, which can aid further compromise.

Critical Impact

A remote attacker can read out-of-bounds memory from the SMB client process, leaking sensitive data across the network without authentication.

Affected Products

• Microsoft Windows 10 (versions 1607, 1809, 21H2, 22H2)
• Microsoft Windows 11 (versions 23H2, 24H2, 25H2, 26H1)
• Microsoft Windows Server 2012, 2016, 2019, 2022, and 2025

Discovery Timeline

• 2026-08-11 - CVE-2026-65794 published to the National Vulnerability Database (NVD)
• 2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-65794

Vulnerability Analysis

The vulnerability is classified as a buffer over-read [CWE-126], where the SMB Client reads past the intended end of a buffer while parsing server responses. The condition arises during network communication with a remote SMB endpoint. An attacker who controls the server can craft protocol responses that cause the client to return memory contents beyond the expected boundary. The disclosed memory may include pointers, session data, or other artifacts useful for chaining attacks. The scope is limited to confidentiality; no integrity or availability impact is reported.

Root Cause

The root cause is improper validation of length or offset fields inside SMB response structures processed by the Windows SMB Client. When the client trusts an attacker-supplied size value, it copies or exposes bytes past the allocated buffer. This behavior is consistent with the CWE-126 buffer over-read class, in which the read length exceeds the intended buffer size but does not corrupt memory.

Attack Vector

The attack vector is network-based and does not require authentication, but it does require user interaction. A typical exploitation path involves a user clicking a UNC path (for example, \\attacker.example.com\share), opening a document with an embedded remote reference, or being redirected to a malicious SMB server through phishing. Once the client connects, the malicious server returns crafted SMB packets that trigger the over-read. Leaked bytes are transmitted back to the attacker within the protocol response cycle.

No verified public proof-of-concept code is available. See the Microsoft Security Update Guide for vendor technical details.

Detection Methods for CVE-2026-65794

Indicators of Compromise

• Outbound SMB connections (TCP 445) from workstations to untrusted or external IP addresses.
• Unexpected UNC path references originating from email attachments, browser downloads, or LNK files.
• SMB client sessions that terminate abruptly or exchange malformed responses with external hosts.

Detection Strategies

• Inspect network telemetry for SMB traffic egressing the enterprise perimeter, which is rarely legitimate.
• Correlate process creation events for Explorer.exe, Office applications, or browsers spawning SMB client activity toward unfamiliar hosts.
• Enable SMB client auditing (Event IDs 31001 and 30622) to record connection failures and anomalous server responses.

Monitoring Recommendations

• Alert on any TCP/445 or TCP/139 flows leaving the corporate network to non-corporate destinations.
• Monitor endpoint DNS queries for hostnames referenced in UNC paths that were not initiated by administrative workflows.
• Track SMB dialect negotiation anomalies and repeated over-read-sized responses from a single external host.

How to Mitigate CVE-2026-65794

Immediate Actions Required

• Apply the Microsoft security update for CVE-2026-65794 to all affected Windows client and server systems.
• Block outbound SMB traffic (TCP 139 and 445) at the network perimeter to prevent connections to attacker-controlled servers.
• Enforce email and web gateway policies that strip or neutralize UNC paths in inbound content.

Patch Information

Microsoft has released fixes through its monthly security update channel. Refer to the Microsoft Security Update Guide for CVE-2026-65794 for the exact KB article and build numbers for each affected Windows version. Deploy the update through Windows Update, WSUS, Microsoft Intune, or your standard patch management workflow.

Workarounds

• Disable the SMB client service (LanmanWorkstation) on hosts that do not require SMB access to file shares.
• Configure host-based firewall rules restricting the SMB client to a defined list of internal file server IP addresses.
• Enable SMB signing and require the latest supported SMB dialect to reduce exposure to malicious server behavior.

# Configuration example: block outbound SMB using Windows Defender Firewall
New-NetFirewallRule -DisplayName "Block Outbound SMB 445" `
  -Direction Outbound `
  -Action Block `
  -Protocol TCP `
  -RemotePort 445 `
  -Profile Any

# Optional: disable the SMB client service on systems that do not need it
Set-Service -Name LanmanWorkstation -StartupType Disabled
Stop-Service -Name LanmanWorkstation -Force