CVE-2026-72936: Windows SMB Client Use After Free Flaw

CVE-2026-72936 Overview

CVE-2026-72936 is a use-after-free vulnerability [CWE-416] in the Windows Server Message Block (SMB) Client. An unauthenticated remote attacker can trigger the flaw over the network and execute arbitrary code in the context of the SMB client process. Exploitation requires no user interaction and no prior privileges, though the attack complexity is high. Microsoft published the advisory on September 8, 2026, and tracks the issue under its September security update guide.

Critical Impact
Successful exploitation grants remote code execution on Windows systems that initiate SMB connections to attacker-controlled endpoints, compromising confidentiality, integrity, and availability.

Affected Products

Microsoft Windows (SMB Client component)
Windows client and server editions supported by the September 2026 update guide
Refer to the Microsoft Security Update Guide for CVE-2026-72936 for the full list of affected builds

Discovery Timeline

2026-09-08 - CVE-2026-72936 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-72936

Vulnerability Analysis

The flaw resides in the Windows SMB Client, the component responsible for initiating and managing SMB sessions with remote file servers. A use-after-free condition occurs when the client references memory that has already been freed during SMB message processing. An attacker who controls a malicious SMB server can respond to a client connection with crafted protocol messages that trigger the dangling pointer, redirecting execution flow. The advisory classifies the issue under [CWE-416], reflecting improper lifecycle management of heap objects tied to SMB session state.

Root Cause

Use-after-free vulnerabilities occur when code continues to operate on a pointer after the underlying object has been released back to the allocator. In the SMB Client, this typically involves session, connection, or response-handling structures freed on one code path while another path still holds a reference. When the freed memory is reallocated with attacker-influenced content, subsequent dereferences can hijack control flow or corrupt adjacent objects. Microsoft has not published root-cause specifics beyond the CWE classification.

Attack Vector

Exploitation is network-based and requires the target Windows system to initiate an SMB connection to an attacker-controlled server. Common triggers include coerced authentication techniques, malicious UNC paths delivered through documents or web content, and lateral movement scenarios where an attacker on the same broadcast domain redirects SMB traffic. No authentication or user interaction is required on the target, though the high attack complexity indicates that reliable exploitation depends on specific timing or memory-layout conditions. No public proof-of-concept exploit is currently available.

See the Microsoft Security Update Guide for CVE-2026-72936 for vendor-supplied technical detail.

Detection Methods for CVE-2026-72936

Indicators of Compromise

Unexpected outbound SMB (TCP/445) connections from workstations to untrusted external or internal hosts
Crashes or abnormal terminations in SMB client user-mode or kernel components following remote share access
Suspicious child processes spawned by services that recently performed SMB operations

Detection Strategies

Hunt for coerced authentication patterns such as sudden bursts of SMB traffic to previously unseen destinations
Correlate Windows Error Reporting entries referencing mrxsmb.sys, mrxsmb20.sys, or related SMB client modules with subsequent process activity
Alert on outbound SMB traffic egressing the network perimeter, which should be blocked in most enterprise environments

Monitoring Recommendations

Enable SMB client audit logging and forward Windows event logs to a centralized analytics platform
Monitor for use of tools and techniques that coerce SMB authentication, including PetitPotam-style requests and rogue print-spooler triggers
Track patch deployment status across the Windows estate to identify systems still exposed to CVE-2026-72936

How to Mitigate CVE-2026-72936

Immediate Actions Required

Apply the September 2026 Microsoft security updates that address CVE-2026-72936 to all supported Windows systems
Block outbound TCP/445 at the network perimeter to prevent SMB client connections to attacker-controlled internet hosts
Inventory systems that regularly initiate SMB traffic and prioritize patching for high-value endpoints and jump hosts

Patch Information

Microsoft has released a security update for CVE-2026-72936. Consult the Microsoft Security Update Guide for CVE-2026-72936 for KB article numbers, affected builds, and download links. Deploy the update through Windows Update, Windows Server Update Services (WSUS), Microsoft Intune, or your standard patch-management tooling.

Workarounds

Restrict SMB client traffic to trusted internal file servers using host-based firewall rules on TCP/445
Disable legacy SMB dialects where feasible and enforce SMB signing to reduce exposure to rogue servers
Segment networks so that user endpoints cannot reach unmanaged or external SMB endpoints

bash

# Example: block outbound SMB on a Windows host using PowerShell
New-NetFirewallRule -DisplayName "Block Outbound SMB 445" `
  -Direction Outbound `
  -Action Block `
  -Protocol TCP `
  -RemotePort 445 `
  -Profile Any