CVE-2026-72957: Windows Deployment Services Buffer Overflow

CVE-2026-72957 Overview

CVE-2026-72957 is a heap-based buffer overflow [CWE-122] in Microsoft Windows Deployment Services (WDS). An authorized local attacker can trigger the overflow to execute arbitrary code in the context of the vulnerable service. The flaw was published to the National Vulnerability Database (NVD) on September 8, 2026, and carries a CVSS 3.1 base score of 7.8.

WDS is a Windows Server role used to deploy Windows operating systems over the network. Successful exploitation impacts confidentiality, integrity, and availability on the affected host. Microsoft has issued guidance through the Microsoft Security Response Center (MSRC).

Critical Impact
Local code execution in the Windows Deployment Services process, enabling privilege escalation and full compromise of the affected host.

Affected Products

Microsoft Windows Server installations with the Windows Deployment Services role enabled
Refer to the Microsoft Security Update Guide for CVE-2026-72957 for the authoritative list of impacted builds
Systems where WDS is exposed to authenticated users capable of invoking service operations

Discovery Timeline

2026-09-08 - CVE-2026-72957 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-72957

Vulnerability Analysis

The vulnerability is a heap-based buffer overflow within Windows Deployment Services. The service allocates a heap buffer whose size is derived from attacker-influenced input, then writes data past the allocated region. This memory corruption allows an authenticated local attacker to overwrite adjacent heap structures.

Because WDS runs with elevated privileges, controlled corruption of heap metadata or function pointers can be leveraged to hijack execution flow. The result is arbitrary code execution in the security context of the WDS service, producing a full impact on confidentiality, integrity, and availability of the host.

Microsoft has not published exploitation details. No public proof-of-concept is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The current EPSS probability is low, reflecting the local attack vector and authentication requirement.

Root Cause

The root cause is a missing or incorrect bounds check in WDS request handling. Attacker-supplied data exceeds the size of the destination heap buffer, corrupting adjacent allocations. Weaknesses of this class map to [CWE-122] Heap-based Buffer Overflow.

Attack Vector

Exploitation requires local access and low privileges (PR:L) with no user interaction. An attacker with an authenticated session on a Windows Server hosting the WDS role can send crafted input to the service and trigger the overflow. Successful exploitation escalates privileges to the service context, which typically operates with SYSTEM-level rights on the deployment server.

Technical specifics of the vulnerable function and exploitation primitives have not been publicly disclosed. Refer to the Microsoft Security Update Guide for CVE-2026-72957 for vendor-provided detail.

Detection Methods for CVE-2026-72957

Indicators of Compromise

Unexpected crashes or restarts of the WDSServer service or associated processes such as WdsServer.exe
Windows Error Reporting entries referencing WDS binaries with heap corruption exceptions (for example, STATUS_HEAP_CORRUPTION or c0000374)
Creation of new processes or child processes spawned by the WDS service that deviate from baseline deployment activity
New service accounts, scheduled tasks, or persistence artifacts created shortly after WDS crash events

Detection Strategies

Monitor Windows Event Logs for Application Error events (Event ID 1000) and Service Control Manager events (Event ID 7031, 7034) tied to WDS binaries
Alert on anomalous child processes of the WDS service, particularly cmd.exe, powershell.exe, or LOLBins spawned in the service context
Correlate authenticated local logons on WDS hosts with subsequent service instability or process anomalies

Monitoring Recommendations

Enable command-line and process-creation auditing (Event ID 4688) on all servers with the WDS role
Restrict and audit membership of administrative and deployment operator groups that can interact with WDS
Forward WDS host telemetry to a centralized SIEM or data lake for cross-host correlation and retention

How to Mitigate CVE-2026-72957

Immediate Actions Required

Apply the security update referenced in the Microsoft Security Update Guide for CVE-2026-72957 as soon as testing permits
Inventory all Windows Server hosts with the WDS role enabled and prioritize patching for internet-adjacent or multi-tenant systems
Review local account privileges on WDS hosts and remove unnecessary interactive logon rights

Patch Information

Microsoft has released fixes through the Microsoft Security Response Center. Consult the Microsoft Security Update Guide for CVE-2026-72957 to identify the correct KB article and cumulative update for each affected Windows Server version. Deploy the update through Windows Update, WSUS, Microsoft Update Catalog, or your standard patch management tooling.

Workarounds

Disable the Windows Deployment Services role on servers where it is not required until patches are applied
Restrict local logon rights on WDS servers to a minimal set of trusted administrators
Segment WDS servers on a dedicated management VLAN and limit administrative access to jump hosts

bash

# Temporarily stop and disable the WDS server service until patching is complete
sc.exe stop WDSServer
sc.exe config WDSServer start= disabled

# Verify current state
sc.exe query WDSServer