Summary
Impact: Remote Code Execution. Microsoft rating: Critical. Not known to be exploited — Exploitation Less Likely. Customer action: Required.
Details
According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?
Successful exploitation of this vulnerability requires an attacker to win a race condition.
How could an attacker exploit this vulnerability?
An attacker could send specially crafted network requests to a Windows Server system that has the Windows Deployment Services (WDS) role enabled and is listening for TFTP traffic. By triggering an error in how the server handles simultaneous requests, an unauthenticated remote attacker could cause the service to use invalid memory, which could allow the attacker to run code on the affected server.
Security updates
10.0.17763.8880 — https://support.microsoft.com/help/5094123
10.0.20348.5256 — https://support.microsoft.com/help/5094128
10.0.26100.32995 — https://support.microsoft.com/help/5094125
10.0.14393.9234 — https://support.microsoft.com/help/5094122
6.2.9200.26132 — https://support.microsoft.com/help/5094042
6.3.9600.23228 — https://support.microsoft.com/help/5094041
Vulnerabilities 1
-
High 8.1
Windows Deployment Services (WDS) Remote Code Execution
Use after free in Windows Deployment Services allows an unauthorized attacker to execute code over a network.
Revision history
-
#1
Information published.
References
-
CVE-2026-42987 Windows Deployment Services (WDS) Remote Code Execution - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42987
-
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
-
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
-
Common Vulnerability Scoring System
https://www.first.org/cvss