Microsoft Windows Server 0-Day Flaw Lets Attackers Crash Servers With a Single Packet

What happened?

Microsoft patched a Windows Server vulnerability that lets a network-adjacent attacker crash a server with a crafted Distributed File System (DFS) referral response. Tracked as CVE-2026-70111, the flaw affects Windows Server 2019, 2022, and 2025. Corelight researchers reported the issue after finding it while testing Microsoft Remote Procedure Call (MS-RPC) and DFS interfaces. The company said it had not seen signs of active exploitation when it disclosed the flaw on October 13, 2026. The vulnerability poses a denial-of-service risk, not server takeover.

Key details

• Corelight researchers discovered the flaw while testing MS-RPC and DFS interfaces and reported no signs of active exploitation at disclosure.
• The root cause is a missing length check in mup.sys that allows an offset pointing to an empty string to trigger an invalid memory reference.
• Crashes produce a blue screen and unexpected reboot; Corelight reproduced the crash 11 out of 11 times on Server 2022 and 3 out of 3 times on Server 2019.
• Windows 10 is not affected because it retains validation checks that are absent in the vulnerable Server builds.
• Repeated triggering can keep critical systems such as domain controllers offline, disrupting key services across an organization.
• Reboots leave minimal forensic evidence, mainly Event IDs 41 and 6008, making internal SMB traffic monitoring essential for detection.

Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.