CVE-2026-96325: CWE-771: Missing Reference to Active Allocated Resource in Microsoft Windows 10 Version 1607

This vulnerability, identified as CWE-771 (Missing Reference to Active Allocated Resource), affects the Windows SMB Server component in multiple versions of Microsoft Windows 10, including Version 1607 and later builds up to specified patched versions. The flaw allows an attacker without privileges or user interaction to trigger a denial of service condition remotely by exploiting the improper handling of allocated resources. The vulnerability is tracked as CVE-2026-96325 and has a CVSS 3.1 base score of 7.5, indicating high severity. Microsoft has released an official fix for this issue.

An unauthorized attacker can exploit this vulnerability remotely over a network to cause denial of service, impacting system availability. There is no impact on confidentiality or integrity according to the CVSS vector. No known exploits are reported in the wild at this time.

An official fix is available from Microsoft. Users and administrators should apply the security updates provided by Microsoft for the affected Windows 10 versions as detailed in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96325. No additional mitigation actions are indicated by the vendor.