CVE-2026-72944: Windows Fax Service Privilege Escalation

CVE-2026-72944 Overview

CVE-2026-72944 is a heap-based buffer overflow [CWE-122] in the Windows Fax Service. An authenticated local attacker can exploit the flaw to elevate privileges on an affected Windows host. Microsoft published the advisory on 2026-09-08 with a CVSS 3.1 base score of 7.8.

The vulnerability requires local access and low privileges, but no user interaction. Successful exploitation yields high impact to confidentiality, integrity, and availability, effectively giving the attacker code execution in the security context of the Fax Service.

Critical Impact
A local, low-privileged attacker can corrupt heap memory in the Windows Fax Service to execute arbitrary code and obtain elevated privileges on the target system.

Affected Products

Microsoft Windows (versions running the Windows Fax Service)
Refer to the Microsoft CVE-2026-72944 Advisory for the definitive list of affected builds
Systems with the Fax Service role enabled or reachable by low-privileged local accounts

Discovery Timeline

2026-09-08 - CVE-2026-72944 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-72944

Vulnerability Analysis

The flaw is a heap-based buffer overflow [CWE-122] within the Windows Fax Service. The service allocates a buffer on the heap and writes attacker-controlled data past the allocated bounds. This corrupts adjacent heap metadata or object pointers, giving the attacker a primitive to influence control flow.

Because the Fax Service runs with elevated privileges, memory corruption inside its process address space translates directly into privilege escalation. An attacker who already holds a low-privileged local account can reach the vulnerable code path and gain SYSTEM-level execution.

The attack is local and non-interactive. No user has to click, open, or approve anything for exploitation to succeed once the attacker can talk to the service.

Root Cause

The root cause is missing or insufficient bounds validation before a heap write inside the Fax Service. Input that should be constrained by size is copied into a fixed-size heap allocation, and the length check is either absent or performed on an untrusted value. Microsoft has not published the specific function or field involved.

Attack Vector

Exploitation requires local access to the target Windows system and a valid low-privileged account. The attacker sends crafted input to the Fax Service through its exposed local interface. Processing that input triggers the out-of-bounds heap write and enables code execution inside the service. See the Microsoft CVE-2026-72944 Advisory for vendor technical detail.

No public proof-of-concept exploit is currently available, and CISA has not added this CVE to the Known Exploited Vulnerabilities catalog. The EPSS score is 0.318%.

Detection Methods for CVE-2026-72944

Indicators of Compromise

Unexpected crashes, restarts, or WER (Windows Error Reporting) entries for the Fax Service process (fxssvc.exe)
Child processes spawned by fxssvc.exe that are not part of normal Fax Service operation, especially command interpreters such as cmd.exe or powershell.exe
New services, scheduled tasks, or local accounts created shortly after Fax Service anomalies
Loading of unsigned or unusual DLLs into the Fax Service process

Detection Strategies

Alert on any process creation where the parent image is fxssvc.exe and the child is a shell, script host, or LOLBin
Monitor for token manipulation or SYSTEM-context process creation originating from a non-SYSTEM parent chain
Correlate Fax Service crashes with subsequent privileged actions on the same host within a short time window
Baseline normal Fax Service behavior and flag deviations in loaded modules and network activity

Monitoring Recommendations

Enable Sysmon Event IDs 1 (process create), 7 (image load), and 11 (file create) with a policy that covers fxssvc.exe
Forward Windows Application and System event logs to a central SIEM and retain crash dumps for the Fax Service
Track service state changes for the Fax Service across the fleet to surface tampering
Review hosts where the Fax Service is running but not operationally required

How to Mitigate CVE-2026-72944

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft CVE-2026-72944 Advisory as soon as it is available for your Windows build
Inventory all systems with the Fax Service installed and prioritize patching multi-user hosts, terminal servers, and jump boxes
Restrict interactive and remote logon rights on systems that must retain the Fax Service
Increase monitoring on fxssvc.exe process activity until patches are deployed

Patch Information

Microsoft has issued guidance for CVE-2026-72944 through the Microsoft Security Response Center. Administrators should consult the Microsoft CVE-2026-72944 Advisory for the exact KB article, affected Windows versions, and update packages that address the heap-based buffer overflow.

Workarounds

Disable and stop the Windows Fax Service (Fax) on systems that do not require fax functionality
Remove the Fax Service role or feature from servers where it is not needed to reduce local attack surface
Limit which local users can interact with the Fax Service through Group Policy and least-privilege account hygiene
Segment and restrict access to hosts that retain the Fax Service until the vendor patch is applied

bash

# Stop and disable the Windows Fax Service on hosts that do not need it
sc.exe stop Fax
sc.exe config Fax start= disabled

# Verify the service is stopped and disabled
sc.exe query Fax
sc.exe qc Fax