CVE-2026-72943: Windows Deployment Services UAF Vulnerability

CVE-2026-72943 Overview

CVE-2026-72943 is a use-after-free vulnerability [CWE-416] in Windows Deployment Services (WDS). An authorized attacker can exploit the flaw over a network to execute arbitrary code on the target system. The vulnerability affects the WDS component used by administrators to deploy Windows operating systems to network clients.

Microsoft published the advisory in its Security Update Guide. Successful exploitation requires low privileges but a high-complexity attack path, which reduces the likelihood of trivial weaponization while preserving high impact on confidentiality, integrity, and availability.

Critical Impact
An authorized network attacker who wins a memory-reuse race in Windows Deployment Services can achieve arbitrary code execution on the WDS host, compromising the server used to provision operating systems across the enterprise.

Affected Products

Microsoft Windows Server with the Windows Deployment Services role enabled
Refer to the Microsoft Security Update Guide for the authoritative list of affected builds
Systems administering PXE-based imaging through WDS

Discovery Timeline

2026-09-08 - CVE-2026-72943 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-72943

Vulnerability Analysis

The flaw is a use-after-free condition in Windows Deployment Services. Use-after-free defects occur when code continues to reference a memory region after that region has been released back to the allocator. When the freed memory is reallocated and populated with attacker-influenced data, subsequent dereferences allow the attacker to control program flow.

In the context of WDS, the vulnerable code path is reachable across the network by an authenticated principal. The attacker must satisfy conditions that make exploitation non-trivial, such as winning a timing race or coercing a specific allocation pattern in the WDS process. Successful exploitation grants code execution in the service context on the WDS host.

Because WDS is typically deployed on infrastructure servers that provision operating system images, compromise of the service can enable downstream tampering with deployment images and pivoting into managed endpoints.

Root Cause

The underlying defect is improper object lifetime management within a WDS handler. A reference to a heap object persists past the free operation, and later code paths dereference the dangling pointer. This is a classic [CWE-416] pattern.

Attack Vector

The attack originates over the network and requires authentication with low privileges. The attacker sends crafted requests to the WDS service to trigger the free and the subsequent use of the released object, then places controlled data into the reclaimed allocation to hijack execution. See the Microsoft Security Update Guide for vendor technical details.

No verified public proof-of-concept code is available at the time of publication.

Detection Methods for CVE-2026-72943

Indicators of Compromise

Unexpected crashes, hangs, or restarts of the WDSServer service on Windows Deployment Services hosts
Anomalous WDS process memory patterns or WerFault.exe dumps referencing WDS binaries
New or modified boot images, install images, or unattend files in the WDS repository without change-control tickets
Authenticated sessions to WDS from hosts that do not normally interact with deployment infrastructure

Detection Strategies

Monitor Windows Event Log channels for WDS service faults, application error events, and unexpected restarts of WDSServer.exe
Alert on child process creation from WDS service binaries, particularly cmd.exe, powershell.exe, or LOLBins
Baseline network traffic to WDS TCP/UDP ports and flag authenticated sessions from unusual source subnets

Monitoring Recommendations

Enable command-line and process-creation auditing on WDS servers and forward events to a central analytics platform
Track file integrity on the WDS image store and TFTP root directories
Correlate authentication events with WDS activity to identify low-privileged accounts interacting with deployment services outside normal maintenance windows

How to Mitigate CVE-2026-72943

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide to all servers running the WDS role
Inventory Windows Server hosts with the Windows Deployment Services role enabled and prioritize patching for internet-adjacent or multi-tenant environments
Restrict which authenticated principals can reach WDS services by tightening network segmentation and firewall rules
Review recent WDS server logs for signs of exploitation attempts prior to patching

Patch Information

Microsoft released a security update addressing CVE-2026-72943. Administrators should consult the Microsoft Security Update Guide for the applicable KB article and per-product patch identifiers, then deploy through Windows Update, WSUS, or a managed patching solution.

Workarounds

Disable the Windows Deployment Services role on servers where it is not actively required until the patch is applied
Limit WDS access to a dedicated deployment VLAN and block the service from general user subnets
Enforce least-privilege on accounts authorized to interact with WDS to reduce the population of principals meeting the low-privilege exploitation prerequisite

bash

# Temporarily stop and disable the WDS service until patched
sc.exe stop WDSServer
sc.exe config WDSServer start= disabled

# Verify the WDS role status via PowerShell
Get-WindowsFeature -Name WDS