CVE-2026-42987
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk45th percentile - higher than 45% of all known CVEs
Summary
Use-After-Free vulnerability in Windows Deployment Services allows an unauthorized attacker to execute code remotely.
Risk Assessment
An attacker could remotely execute malicious code, potentially leading to full system compromise and lateral movement within the network.
Recommendation
Install the latest security patch from Microsoft for Windows Deployment Services.
Other vulnerabilities in Windows Deployment Services
See all- CVE-2026-0386High
A vulnerability in Windows Deployment Services is due to improper access control. An unauthorized attacker can execute code over an adjacent network.
- CVE-2026-62893Critical
A use-after-free vulnerability in Windows Deployment Services allows an unauthorized attacker to execute code over a network.
- CVE-2023-35322High
A vulnerability in Windows Deployment Services allows remote code execution by an attacker. Exploiting this flaw could lead to system takeover.
- CVE-2023-35321Medium
A vulnerability in Windows Deployment Services allows attackers to remotely trigger a fault, leading to denial of service. Exploiting this flaw may result in service unavailability for users.
Original NVD description (English source)
Use after free in Windows Deployment Services allows an unauthorized attacker to execute code over a network.