{"id":"CVE-2026-105558","kind":"vulnerability","aliases":["CVE-2026-105558"],"related":[],"title":"Windows Deployment Services: heap overflow lets an authorized user run code remotely","description":"Heap-based buffer overflow in Windows Deployment Services allows an authorized attacker to execute code over a network.","summary":"Windows Deployment Services has a heap-based buffer overflow that lets an authorized attacker run code over the network. The attacker needs valid access to the service first, and the advisory does not state a fixed version.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","wds","windows","windows-server"],"not_affected_if":["role-not-installed"],"how_to_check":"- Check whether the Windows Deployment Services role is installed on the server (unknown if the sources give a command)","fix":null,"status":"open","published_at":"2026-11-10T19:17:58+00:00","first_seen_at":"2026-11-10T19:24:19+00:00","triaged_at":"2026-11-10T19:47:29+00:00","updated_at":"2026-11-10T19:47:29+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T19:47:29Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Windows Deployment Services: heap overflow lets an authorized user run code remotely","impact":"high","summary":"Windows Deployment Services has a heap-based buffer overflow that lets an authorized attacker run code over the network. The attacker needs valid access to the service first, and the advisory does not state a fixed version.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","windows-server","wds"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"attacker runs code on the deployment server over the network","analyst_note":"Confirm affected Windows Server builds and the fixed update from the Microsoft Security Response Center entry for CVE-2026-105558.","how_to_check":"- Check whether the Windows Deployment Services role is installed on the server (unknown if the sources give a command)\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["role-not-installed"],"who_is_affected":"Organisations that run Windows Deployment Services to push operating system images to machines on their network are the ones exposed. Servers without the role installed are not affected. The sources do not say which Windows builds are affected.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000681,"input_tokens":4490,"output_tokens":464,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Confirm affected Windows Server builds and the fixed update from the Microsoft Security Response Center entry for CVE-2026-105558.","search":"'-105558':15A,18A '-2026':14A,17A 'access':49B 'advisori':56B 'allow':72C 'attack':39B,46B,75C 'author':8A,38B,74C 'base':32B,65C 'buffer':33B,66C 'code':11A,41B,78C 'cve':13A,16A 'deploy':2A,26B,70C 'execut':77C 'first':53B 'fix':61B 'heap':4A,31B,64C 'heap-bas':30B,63C 'infrastructur':19B 'let':6A,36B 'need':47B 'network':44B,81C 'overflow':5A,34B,67C 'remot':12A 'run':10A,40B 'server':24B 'servic':3A,27B,52B,71C 'state':59B 'user':9A 'valid':48B 'version':62B 'wds':20B 'window':1A,21B,23B,25B,69C 'windows-serv':22B","nicknames":[],"mitigations":[],"who_affected":"Organisations that run Windows Deployment Services to push operating system images to machines on their network are the ones exposed. Servers without the role installed are not affected. The sources do not say which Windows builds are affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","infrastructure","wds","windows","windowsserver"],"campaign_type":null,"search_a":"'-105558':15A,18A '-2026':14A,17A 'author':8A 'code':11A 'cve':13A,16A 'deploy':2A 'heap':4A 'let':6A 'overflow':5A 'remot':12A 'run':10A 'servic':3A 'user':9A 'window':1A","search_b":"'access':49B 'advisori':56B 'attack':39B,46B 'author':38B 'base':32B 'buffer':33B 'code':41B 'deploy':26B 'first':53B 'fix':61B 'heap':31B 'heap-bas':30B 'infrastructur':19B 'let':36B 'need':47B 'network':44B 'overflow':34B 'run':40B 'server':24B 'servic':27B,52B 'state':59B 'valid':48B 'version':62B 'wds':20B 'window':21B,23B,25B 'windows-serv':22B","search_c":"'allow':72C 'attack':75C 'author':74C 'base':65C 'buffer':66C 'code':78C 'deploy':70C 'execut':77C 'heap':64C 'heap-bas':63C 'network':81C 'overflow':67C 'servic':71C 'window':69C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:17:58+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-105558","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105558","severity":null,"published_at":"2026-11-10T19:17:58+00:00","modified_at":"2026-11-10T19:17:58+00:00","first_seen_at":"2026-11-10T19:24:19+00:00","fetched_at":"2026-11-10T19:24:19+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}