CVE-2026-72965

CVE-2026-72965 is a use-after-free memory-safety flaw (CWE-416) in the Windows WebClient Service, the component that provides the WebDAV client/redirector functionality on Windows. An attacker who already has an authorized low-privilege account can trigger the flaw locally by causing the service to use freed memory, with no user interaction required. Successful exploitation elevates the attacker's privileges locally, with high impact on confidentiality, integrity, and availability in the local context. Any Windows system where the WebClient Service is present and running is affected; the specific affected version ranges were not provided in the available data. No public proof-of-concept is known, the flaw is not listed in CISA KEV, and EPSS estimates only about a 0.3% probability of exploitation within 30 days, so no exploitation has been observed.

What to do: Apply the Microsoft security update for CVE-2026-72965 via Windows Update as soon as it is available to your patching rings, checking the Microsoft advisory for the affected version ranges. As an interim mitigation, set the WebClient service Startup type to Disabled (e.g., 'sc config WebClient start= disabled') on hosts that do not need the WebDAV redirector, and confirm its current state with 'sc query WebClient' or 'Get-Service WebClient'. Because exploitation requires local access, prioritize multi-user systems such as RD Session Hosts, VDI hosts, and shared workstations, and track Microsoft's advisory for updated affected-product details.