CVE-2026-42987: Windows Deployment Services (WDS) Remote Code Execution

Synopsis

A use-after-free vulnerability in Windows Deployment Services (WDS) allows an unauthenticated remote attacker to execute arbitrary code on affected Windows Server systems. The flaw is reachable over the network without any login credentials, though exploitation requires meeting certain environmental conditions reflected in the high attack complexity rating. Successful exploitation gives the attacker full control over code execution, with high impact across confidentiality, integrity, and availability. Patched-image rebuilds at the applicable fix versions (6.2.9200.26132, 6.3.9600.23228, 10.0.14393.9234, 10.0.17763.8880, and 10.0.20348.5256) are available on HarborGuard for environments running affected versions.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the WDS service over the network; the vulnerability is exposed via a network-accessible endpoint (AV:N).

• AuthenticationNot required

  No credentials or account of any privilege level are needed to attempt exploitation (PR:N).

• Victim interactionNot required

  No user action or social engineering is required; the attacker can trigger the vulnerability without any victim participation (UI:N).

• Attack complexityDetail

  Exploitation is rated high complexity (AC:H), meaning the attacker must satisfy specific environmental conditions such as timing constraints, memory layout dependencies, or race conditions to reliably trigger the use-after-free.

Blast Radius

• A successful attacker executes arbitrary code in the context of the WDS service process, gaining direct control over the server.
• The attacker reads sensitive data accessible to the service, including network boot configurations, image payloads, and credential material stored or cached by WDS.
• The attacker modifies or replaces deployment images and server-side configuration, enabling tampering with OS images delivered to client machines during network boot.
• The attacker crashes or destabilizes the WDS service, preventing network-based OS deployments across any clients relying on that server.