Microsoft OpenSSH for Windows use-after-free enables remote code execution

Use after free in OpenSSH for Windows allows an unauthorized attacker to execute code over a network.

• Windows 10 Version 1809: the record marks 10.0.17763.0 as affected when it is less than 10.0.17763.9376.
• Windows 10 Version 21H2: the record marks 10.0.19044.0 as affected when it is less than 10.0.19044.7807.
• Windows 10 Version 22H2: the record marks 10.0.19045.0 as affected when it is less than 10.0.19045.7807.
• Windows 11 version 23H2: the record lists two entries with the same scope, with 10.0.22631.0 affected when it is less than 10.0.22631.7652.
• Windows 11 Version 24H2: 10.0.26100.0 is affected when it is less than 10.0.26100.9711.
• Windows 11 Version 25H2: 10.0.26200.0 is affected when it is less than 10.0.26200.9711.
• Windows 11 version 26H1: 10.0.28000.0 is affected when it is less than 10.0.28000.3231.
• Windows 11 Version 26H2: 10.0.26300.0 is affected when it is less than 10.0.26300.9711.
• Windows Server 2019 and Windows Server 2019 (Server Core installation): 10.0.17763.0 is affected when it is less than 10.0.17763.9376.
• Windows Server 2022: 10.0.20348.0 is affected when it is less than 10.0.20348.5761.
• Windows Server 2025 and Windows Server 2025 (Server Core installation): 10.0.26100.0 is affected when it is less than 10.0.26100.33650.

Microsoft OpenSSH for Windows contains a CWE-416, Use After Free flaw in which a memory region may be used after it has been released. An attacker-controlled network interaction may reach the affected processing path and result in remote code execution, but the record does not identify the protocol message, specific request, or code path that triggers the flaw. The supplied attack characteristics indicate network reachability, no authentication, no prior privileges, no user interaction, and low attack complexity. The record does not identify a required service configuration, listening interface, or privilege context for the resulting code. The specific implementation details of the use-after-free remain unknown from the available evidence.

The flaw may be reachable over the network on systems where OpenSSH for Windows can be accessed. The supplied attack characteristics indicate that an attacker needs no authentication, no prior privileges, and no user interaction, and that the attack has low complexity. The supplied record does not record a public exploit, and known_exploited has no value confirming known exploitation. The consulted SSVC enrichment records exploitation as none, but that is a bounded assessment and does not rule out unreported activity or abuse discovered later.

Technically, the memory-lifetime flaw can be converted into remote code execution on an affected host. A successful attack could affect the system's confidentiality, integrity, and availability. The described path requires no authentication and no user interaction, while the assessed scope remains limited to the affected system. The record does not establish whether the resulting code runs with service, user, or system privileges, so the post-exploitation privilege level should not be assumed. It also provides no evidence that exploitation automatically spreads to other systems.

Successful exploitation could give an attacker code execution on an affected Windows host, with possible loss of confidentiality, integrity, and availability. Because the attack does not require an account or user action, systems that are reachable over the network may require priority review and patching. The actual consequence may depend on the privileges of the affected process and the deployment configuration, neither of which is specified in the record. The evidence does not identify a particular organization as breached.

1. Apply the Microsoft security update to every affected branch. Verify that the post-update build is not below the applicable boundary: 10.0.17763.9376 for Windows 10 Version 1809 and Windows Server 2019, 10.0.19044.7807 for Windows 10 Version 21H2, 10.0.19045.7807 for Windows 10 Version 22H2, 10.0.22631.7652 for Windows 11 Version 23H2, 10.0.26100.9711 for Windows 11 Version 24H2, 10.0.26200.9711 for Windows 11 Version 25H2, 10.0.28000.3231 for Windows 11 version 26H1, 10.0.26300.9711 for Windows 11 Version 26H2, 10.0.20348.5761 for Windows Server 2022, and 10.0.26100.33650 for Windows Server 2025.
2. Include Server Core deployments in the review and patch rollout. Do not treat an update for one Windows branch as evidence that parallel branches are fixed.
3. If immediate patching is not possible, restrict network access to systems running OpenSSH for Windows as a temporary precaution. The supplied record does not provide a Microsoft-confirmed interim mitigation.
4. After deployment, recheck inventory, patch status, and network reachability to confirm that affected systems have been addressed.

1. Inventory Windows client and server systems that have OpenSSH for Windows installed, enabled, or reachable over the network.
2. Record the operating system edition, release branch, and current build, including Windows Server Core systems.
3. Compare each build with the branch-specific boundaries in affected_summary. Do not infer that one branch is safe because another branch has been updated.
4. Check patch-management records to confirm that the Microsoft update was successfully applied and that any required restart or remaining deployment step has completed.
5. Review network logs and host telemetry for connections to systems running OpenSSH for Windows and unusual behavior after a host was in an affected state. This is precautionary monitoring, not a CVE-specific indicator.
6. No specific IOC, log event, file path, or function name is provided. The absence of suspicious evidence does not prove that a system is unaffected or was not exploited.