CVE-2026-72931: CWE-772: Missing Release of Resource after Effective Lifetime in Microsoft Windows 10 Version 1607

This vulnerability (CVE-2026-72931) involves a missing release of a resource after its effective lifetime in the Windows Secure Socket Tunneling Protocol (SSTP) implementation. This flaw allows an authorized attacker with local access to cause a denial of service condition by exhausting resources. The vulnerability affects multiple Windows 10 versions starting from build 14393 up to but excluding various fixed builds, as well as some Windows 8.1 builds. The CVSS 3.1 base score is 4.7, reflecting a medium severity with local attack vector, high attack complexity, low privileges required, no user interaction, and impact limited to availability. Microsoft has issued an official fix for this vulnerability.

An authorized local attacker can exploit this vulnerability to cause a denial of service by preventing the release of resources after their effective lifetime in SSTP, potentially leading to system instability or service disruption. There is no impact on confidentiality or integrity, only availability is affected.

An official fix is available from Microsoft. Users and administrators should apply the security updates provided by Microsoft for the affected Windows 10 versions as detailed in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-72931. No additional mitigation actions are specified or required beyond applying the official patch.