CVE-2026-69572 Overview
CVE-2026-69572 is an out-of-bounds read vulnerability [CWE-125] in the Windows Server Message Block (SMB) Client. An authorized attacker can exploit the flaw to disclose information over a network. The vulnerability requires low privileges and user interaction, and the attack complexity is low. Successful exploitation exposes confidential memory contents from the client process handling SMB responses.
Critical Impact
An authenticated remote attacker who convinces a user to interact with a malicious SMB response can read out-of-bounds memory from the Windows SMB Client, leading to information disclosure.
Affected Products
- Microsoft Windows (SMB Client component)
- Windows client and server editions using the affected SMB Client stack
- Refer to the Microsoft Security Update Guide for CVE-2026-69572 for the authoritative list of affected builds
Discovery Timeline
- 2026-09-08 - CVE-2026-69572 published to the National Vulnerability Database
- 2026-09-08 - Last updated in the NVD database
Technical Details for CVE-2026-69572
Vulnerability Analysis
The vulnerability resides in the Windows SMB Client, which handles communication with SMB servers for file and resource sharing. The client reads data beyond the allocated bounds of a buffer while parsing server-supplied data structures. This out-of-bounds read [CWE-125] exposes adjacent process memory to the attacker. Disclosed memory may contain sensitive data such as authentication material, session tokens, or fragments of prior SMB traffic.
Exploitation requires the victim client to interact with an attacker-controlled or attacker-influenced SMB endpoint. The attacker must already hold some level of network authorization, which limits the eligible threat population. Impact is confined to confidentiality; the flaw does not permit modification or denial of service according to the published CVSS metrics.
Root Cause
The defect is a missing or insufficient bounds check when the SMB Client parses response fields returned by an SMB server. The client trusts a length or offset value from the server without validating it against the actual buffer size. When the client reads based on the untrusted value, it accesses memory outside the intended structure.
Attack Vector
The attack path is network-based. An authenticated attacker hosts or controls an SMB endpoint and returns crafted response packets. A Windows user is induced to open a UNC path, browse a share, or otherwise trigger an SMB client connection to the malicious endpoint. The client processes the malformed response and returns out-of-bounds memory contents to the attacker over the SMB session.
No verified public exploit code is available. See the Microsoft Security Update Guide for CVE-2026-69572 for vendor-supplied technical details.
Detection Methods for CVE-2026-69572
Indicators of Compromise
- Outbound SMB (TCP/445) connections from workstations to untrusted external IP addresses or non-corporate file servers.
- Unusual UNC path access originating from email clients, browsers, or Office applications.
- SMB sessions to newly registered domains or non-enterprise hosts within short time windows.
Detection Strategies
- Inspect network telemetry for SMB traffic egressing the enterprise perimeter, which should typically be blocked.
- Correlate process execution events with subsequent SMB client connections to identify user-initiated triggers such as explorer.exe opening a remote UNC path.
- Alert on SMB responses with anomalous or malformed length fields observed by network sensors capable of protocol parsing.
Monitoring Recommendations
- Enable Windows SMB client auditing and forward events to a centralized log platform.
- Monitor endpoints for repeated SMB client crashes or memory access exceptions in mrxsmb.sys and related drivers.
- Track authentication events tied to outbound SMB sessions to identify authorized users being redirected to untrusted endpoints.
How to Mitigate CVE-2026-69572
Immediate Actions Required
- Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-69572 as soon as testing permits.
- Block outbound TCP/445 and TCP/139 at the perimeter firewall to prevent clients from reaching untrusted SMB endpoints.
- Educate users to avoid clicking UNC paths or SMB links from untrusted sources.
Patch Information
Microsoft has published a security update through the Microsoft Security Update Guide. Administrators should consult the Microsoft Security Update Guide for CVE-2026-69572 for the specific KB articles, build numbers, and product versions addressed by the fix. Deploy patches through Windows Update, Windows Server Update Services (WSUS), or Microsoft Intune according to the organization's change management process.
Workarounds
- Restrict SMB client traffic to trusted internal file servers using host-based firewall rules.
- Disable outbound SMB connectivity for user endpoints where remote file share access is not required.
- Apply Group Policy to prevent automatic authentication to untrusted SMB servers and enforce SMB signing.
# Block outbound SMB on Windows endpoints via PowerShell
New-NetFirewallRule -DisplayName "Block Outbound SMB 445" -Direction Outbound -Action Block -Protocol TCP -RemotePort 445
New-NetFirewallRule -DisplayName "Block Outbound SMB 139" -Direction Outbound -Action Block -Protocol TCP -RemotePort 139
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
