CVE-2026-73009: CWE-416: Use After Free in Microsoft Windows 10 Version 1607

CVE-2026-73009 is a use-after-free vulnerability (CWE-416) in the Windows Secure Socket Tunneling Protocol (SSTP) component of Microsoft Windows 10. This vulnerability allows remote attackers to execute arbitrary code by exploiting improper memory handling, leading to potential full system compromise. It affects multiple Windows 10 builds starting from 10.0.14393.0 up to but not including various patched builds (e.g., <10.0.14393.9512, <10.0.17763.9245, etc.). The vulnerability is rated critical with a CVSS 3.1 base score of 9.8, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. Microsoft has released official patches to address this issue.

Successful exploitation of this vulnerability allows an unauthenticated attacker to execute arbitrary code remotely on affected Windows 10 systems via the SSTP service. This can lead to full system compromise, including complete control over the affected machine, data theft, or disruption of service. The vulnerability does not require user interaction or privileges, increasing its risk.

An official fix is available from Microsoft. Users and administrators should apply the security updates provided by Microsoft for the affected Windows 10 versions as soon as possible. Refer to the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-73009 for detailed patch information and update instructions.