CVE-2026-72981

CVE-2026-72981 is a use-after-free memory corruption flaw (CWE-416) in the IP Helper service of Microsoft Windows, assigned by Microsoft and addressed in the September 2026 security updates. An unauthenticated remote attacker can trigger the condition by getting the service to process malicious network input, though the high attack-complexity metric (AC:H) means reliable exploitation likely depends on specific memory layout or timing conditions. Successful exploitation grants the attacker arbitrary code execution on the target host with the privileges of the IP Helper service. Any Windows system running the IP Helper service, which is enabled by default on typical Windows installations, is potentially affected, although the disclosure does not specify exact affected version ranges. No public proof-of-concept, CISA KEV listing, or known in-the-wild exploitation exists; EPSS currently estimates only a 0.5% probability of exploitation within 30 days.

What to do: Apply Microsoft's September 2026 security updates (the relevant cumulative update for each Windows build) across endpoints and servers, prioritizing internet-exposed Windows hosts. Because the disclosure does not list exact affected versions, verify against Microsoft's advisory which builds require the fix before scheduling. Until patched, favor standard patch-cycle prioritization given the high attack complexity and lack of known exploitation, and review systems where the IP Helper service processes untrusted network traffic.