CVE‑2026‑44656 – Remote Code Execution via SMB

Impact

• Affected systems: Windows 10 (1909‑22H2) and Windows 11 (21H2‑22H2)
• Severity: CVSS 9.8 (Critical)
• Exploit vector: Remote network
• Potential damage: Full system compromise, data exfiltration, ransomware deployment.

Technical Details

CVE‑2026‑44656 is a buffer overflow in the SMBv3 protocol stack. An attacker sends a specially crafted packet containing a 32‑bit length field that exceeds the allocated buffer. The overflow lands on the stack, allowing arbitrary code execution with SYSTEM privileges. The flaw exists in the handling of the SMB2_CREATE request. It is triggered without authentication, making it exploitable over open networks.

Affected Versions

Product	Edition	Build range	Update status
Windows 10	All	1909 to 22H2	Unpatched
Windows 11	All	21H2 to 22H2	Unpatched

Mitigation Steps

1. Apply the latest cumulative update. Download from the Microsoft Update Catalog.
2. Disable SMBv3 on non‑essential servers using Group Policy: Computer Configuration → Administrative Templates → Network → Server Message Block (SMB) 1.0/CIFS File Sharing Support → Enable insecure guest logons set to Disabled.
3. Restrict inbound SMB traffic via firewalls. Allow only trusted IP ranges.
4. Enable Windows Defender Exploit Guard and set the Attack Surface Reduction rule DLLs that can be loaded from memory to Block.
5. Verify patch deployment with wmic qfe get HotFixID,Description,InstalledOn and confirm KB5005565 is present.

Timeline

• 2026‑04‑15: CVE disclosed by Microsoft Security Response Center (MSRC).
• 2026‑04‑20: Initial advisory released.
• 2026‑04‑25: Cumulative update KB5005565 published.
• 2026‑05‑01: MSRC recommends immediate patching.

Resources

• Microsoft Security Advisory – CVE‑2026‑44656
• KB5005565 – Security update for Windows 10 and 11
• SMBv3 Security Guidance
• Windows Defender Exploit Guard Documentation

Final Note

Fail to patch or mitigate within 48 hours increases the risk of enterprise compromise. Deploy the update immediately, monitor for anomalous SMB traffic, and validate the patch status across all endpoints.