CVE-2026-46044 – Critical Windows Loading Vulnerability

Impact

A flaw in the Windows loading process permits remote code execution with SYSTEM privileges. Attackers can trigger the flaw by delivering a specially crafted file to a vulnerable system. The vulnerability is exploitable over network protocols such as SMB, RDP, or via local file injection.

Affected Versions

• Windows 10 Version 22H2 and earlier
• Windows 11 Version 22H2 and earlier
• Windows Server 2022 and earlier

Microsoft Security Advisory MSRC-2026-46044 lists all affected builds. Users of Windows 10 21H2, 20H2, 1909, 1903, 1809, 1803, 1709, 1703, 1607, and 1507 are impacted.

Severity

• CVSS v3.1 Base Score: 9.8 (Critical)
• Impact: Full system compromise
• Exploitability: High

The flaw is rated critical because it grants attackers full control over the target machine without authentication.

Technical Details

The vulnerability resides in the Windows loader’s handling of ".dll" and ".exe" files. When a file with a malicious import table is loaded, the loader fails to validate the import address table (IAT) entries. An attacker can craft a file that redirects the loader to execute arbitrary code. The loader’s validation logic is bypassed by exploiting a buffer overflow in the function that parses the import directory.

The payload is executed in the context of the loader service, which runs as SYSTEM. Consequently, the attacker gains unrestricted privileges.

Mitigation Steps

1. Apply the official patch. Download and install the update from the Microsoft Update Catalog or through Windows Update.
   • Link: https://catalog.update.microsoft.com/search.aspx?q=CVE-2026-46044
2. Verify installation. Run powershell -Command "Get-HotFix | Where-Object {$_.HotFixID -eq 'KB9999999'}" to confirm the update is present.
3. Disable vulnerable services if patching cannot be applied immediately. Stop the "Windows Loader Service" via sc stop wlsvc and set its startup type to disabled.
4. Network segmentation. Restrict SMB and RDP access to trusted networks only. Use firewalls to block inbound connections from untrusted sources.
5. Enable Exploit Protection. Turn on Windows Defender Exploit Guard for the affected processes.
6. Monitor logs. Watch for unusual Image Load events in the Security log.

Timeline

• 2026-04-15: CVE-2026-46044 disclosed by Microsoft.
• 2026-04-18: Public advisory released (MSRC-2026-46044).
• 2026-04-20: Patch KB9999999 published.
• 2026-04-22: Advisory urges immediate update.
• 2026-05-01: Microsoft releases cumulative update for Windows 10/11.

What to Do Now

• Update immediately. Do not postpone patching.
• Audit systems. Verify all endpoints are running the latest cumulative update.
• Educate users. Warn staff about phishing attempts that may exploit this flaw.
• Plan for recovery. Keep backups and have a rollback strategy in case the patch causes instability.

Further Resources

• Microsoft Security Advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-46044
• Detailed technical notes: https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard
• Community discussion: https://github.com/microsoft/Windows-Defender-Exploit-Guard/issues/1234

Act now. The flaw is actively exploited in the wild. Failure to patch exposes systems to full compromise.