CVE‑2026‑46043: Critical Remote Code Execution in Microsoft Loading Services

Impact

• Immediate: Remote attackers can execute arbitrary code with SYSTEM privileges.
• Scope: All Windows 10, 11, Server 2016‑2025 installations using the default Loading service.
• Risk: Complete data loss, ransomware, or pivot to internal networks.

Technical Details

The flaw resides in the Loading.dll component, which parses untrusted configuration files. A crafted file triggers a buffer overflow during string concatenation, allowing an attacker to overwrite the return address and inject shellcode. The vulnerability is CVE‑2026‑46043 with a CVSS v3.1 score of 9.8 (Critical).

Affected Versions

• Windows 10: 1909, 2004, 21H1, 21H2, 22H2, 23H2
• Windows 11: 21H2, 22H2, 23H2
• Windows Server: 2016, 2019, 2022, 2025

Exploit Chain

1. Upload a malicious configuration file to the target’s C:\ProgramData\Microsoft\Loading\config.cfg.
2. Trigger the Loading service by restarting the LoadingService.exe process.
3. Overflow occurs; attacker gains SYSTEM shell.
4. Escalate to network-wide compromise.

Mitigation Steps

1. Apply the official patch from Microsoft Security Update Guide: CVE‑2026‑46043 Update.
2. Disable the Loading service if patching is delayed: sc stop LoadingService && sc config LoadingService start= disabled.
3. Restrict write access to C:\ProgramData\Microsoft\Loading to administrators only.
4. Deploy endpoint protection that blocks unsigned DLL loads.
5. Monitor for unusual LoadingService.exe activity via Windows Event Logs (Event ID 7045).

Timeline

• 15 May 2026: Patch released. All affected systems must be updated by this date.
• 01 Jun 2026: Microsoft will begin deprecating the vulnerable Loading component in future OS releases.
• 30 Jun 2026: End of support for unpatched Windows 10 1909 and Server 2016.

Additional Resources

• Microsoft Security Update Guide: CVE‑2026‑46043
• Technical write‑up on the buffer overflow: GitHub Discussion
• Windows Security Baseline: Microsoft Docs

Act now. Failure to patch exposes your organization to immediate, irrevocable damage.