Input validation error in Microsoft Windows and Windows Server - CVE-2026-105008

Vulnerability details

The vulnerability allows a remote attacker to impersonate another user, access information permitted by that user's permissions, and execute code on the target system.

The vulnerability exists due to an unspecified weakness in Windows Schannel when handling network packets. A remote attacker can send a specially crafted packet to an affected service over the network to impersonate another user, access information permitted by that user's permissions, and execute code on the target system.

No user interaction is required. Successful exploitation requires a deep understanding of the system and the ability to manipulate its components to trigger a specific condition; success depends on environmental and system configuration factors.

Affected software

How to mitigate CVE-2026-105008

External References

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-105008

Related Security Bulletins

• Multiple vulnerabilities in Microsoft Windows