Use-after-free in Microsoft Windows and Windows Server - CVE-2026-125134

Vulnerability details

The vulnerability allows a remote attacker on the local network to execute arbitrary code as SYSTEM on an affected system.

The vulnerability exists due to use-after-free in the Windows Function Discovery Resource Publication service when processing SOAP requests. A remote attacker on the local network can send specially crafted SOAP requests to the service to execute arbitrary code as SYSTEM.

Exploitation requires a low-memory allocation failure and winning an asynchronous request-cleanup timing condition.

Affected software

How to mitigate CVE-2026-125134

External References

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-125134
• https://support.microsoft.com/help/5131291

Related Security Bulletins

• Multiple vulnerabilities in Microsoft Windows