CVE-2026-72965: Windows WebClient Service UAF Vulnerability

CVE-2026-72965 Overview

CVE-2026-72965 is a use-after-free vulnerability [CWE-416] in the Windows WebClient Service. An authorized local attacker can exploit the flaw to elevate privileges on an affected Windows host. The issue affects confidentiality, integrity, and availability at the local scope, requiring low privileges and no user interaction.

Microsoft published details through its Security Update Guide. See the Microsoft Security Update CVE-2026-72965 advisory for vendor guidance.

Critical Impact
Successful exploitation grants an attacker elevated privileges on the target system, enabling further compromise of the host and lateral movement.

Affected Products

Microsoft Windows (WebClient Service component)
Refer to the Microsoft Security Update Guide for the complete list of impacted Windows builds
Systems where the WebClient (WebDAV) service is running are within scope

Discovery Timeline

2026-09-08 - CVE-2026-72965 published to the National Vulnerability Database
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-72965

Vulnerability Analysis

The vulnerability is a use-after-free condition in the Windows WebClient Service, which implements the client-side WebDAV protocol on Windows. A use-after-free occurs when code continues to reference memory after it has been released, allowing an attacker to control freed memory contents and influence program flow.

The attack requires local access with low privileges and no user interaction. Successful exploitation results in code execution in the security context of the WebClient service, producing local privilege escalation. According to the current EPSS data, exploitation probability in the wild remains low.

Root Cause

The root cause is improper object lifetime management within the WebClient Service. The service dereferences a memory object after it has been freed, and an attacker who can trigger reallocation of that memory region controls the resulting object state. This class of flaw is tracked under CWE-416: Use After Free.

Attack Vector

An authenticated local user interacts with the WebClient service through documented WebDAV client interfaces or RPC endpoints exposed by the service. By racing or repeatedly invoking a code path that frees an object still referenced elsewhere, the attacker triggers the dangling reference. Reoccupying the freed allocation with attacker-controlled data enables privilege escalation to the service's context.

No public proof-of-concept exploit is currently available. Refer to the Microsoft Security Update CVE-2026-72965 advisory for additional technical context.

Detection Methods for CVE-2026-72965

Indicators of Compromise

Unexpected crashes or restarts of the WebClient service (svchost.exe hosting webclnt.dll)
New processes spawned by the WebClient service running with elevated privileges
Unusual local invocations of WebDAV client APIs from low-privileged user sessions

Detection Strategies

Alert on child process creation from svchost.exe instances hosting the WebClient service where the child runs under SYSTEM after being invoked from a standard user context
Monitor Windows Error Reporting and application crash telemetry for repeated faults in webclnt.dll preceding privilege changes
Correlate token elevation events (Event ID 4672) with prior local user activity involving WebDAV endpoints

Monitoring Recommendations

Enable Sysmon Event ID 1 (process creation) and Event ID 10 (process access) with rules covering the WebClient service host
Forward Windows Security, System, and Application logs to a centralized SIEM for correlation
Track service state changes on the WebClient service across the estate to identify anomalous stops and restarts

How to Mitigate CVE-2026-72965

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide to all affected Windows systems
Prioritize patching on multi-user hosts such as terminal servers, VDI, and shared workstations where local attackers are more likely
Audit accounts with interactive logon rights and reduce local access where possible

Patch Information

Microsoft has published fixes through the Security Update Guide. Deploy the vendor patch that corresponds to each affected Windows build via Windows Update, WSUS, Microsoft Intune, or Configuration Manager. Verify installation using the KB identifiers listed in the advisory.

Workarounds

Disable the WebClient service on hosts that do not require WebDAV client functionality using sc.exe config WebClient start= disabled
Restrict interactive and remote interactive logon rights via Group Policy to limit which users can trigger local exploitation
Apply application control policies (Windows Defender Application Control or AppLocker) to constrain unauthorized binaries that could be used in an exploit chain

bash

# Configuration example: disable the WebClient service where not required
sc.exe stop WebClient
sc.exe config WebClient start= disabled