Loading vulnerability…
Windows Virtual Filtering Platform Use-After-Free Remote Code Execution
CVE-2026-95962 is a use-after-free vulnerability in Windows Virtual Filtering Platform (VFP) that permits unauthenticated remote code execution. An attacker can trigger the vulnerability by sending a specially crafted packet to an affected network service, but successful exploitation requires winning a race condition. No user interaction is required. Microsoft assigns a CVSS v3.1 base score of 9.0 and assesses exploitation as less likely. Specific vulnerable functions and affected versions are not identified.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows remote execution of attacker-controlled code on the affected system. The CVSS assessment indicates high confidentiality, integrity, and availability impacts and changed security scope. The execution privilege level is not specified.
If you can’t patch tonight, do this now.
No vulnerability-specific interim mitigation or workaround is identified. Consult Microsoft's vulnerability guidance for any available workarounds; an official security update is available.
Patch, then assume compromise.
Apply the Microsoft security update addressing CVE-2026-95962, released as part of the November 2026 security updates. Consult the Microsoft Security Response Center Security Update Guide to identify the applicable package for each Windows release and architecture. An official fix is available, but specific KB identifiers and fixed builds are not identified.
No public exploits tracked yet. Mallory keeps watching.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.