CVE-2026-44805: Windows Network Controller Host Agent Use-After-Free DoS Vulnerability

Technical summary

CVE-2026-44805 is a use-after-free memory corruption vulnerability (CWE-416, CWE-822) in the Windows Network Controller Host Agent service. The flaw occurs when the NC Host Agent fails to properly manage memory references, allowing an authenticated local attacker to trigger a reference to freed memory. This results in service crash or instability, effectively denying availability of network controller functionality. The vulnerability requires local code execution capability and user-level privileges to trigger.

Business impact

This vulnerability primarily affects availability of Network Controller management infrastructure. For organizations relying on NC Host Agent for Software Defined Networking (SDN) operations—particularly in Hyper-V and cloud environments—exploitation can disrupt network provisioning, configuration updates, and virtual network management. The impact scales with dependency on NC; smaller deployments may see limited business disruption, while large-scale SDN infrastructures could experience significant operational downtime. No data theft or privilege escalation is possible through this flaw.

Affected systems

Windows Server 2019, Windows Server 2022, and Windows Server 2025 are affected. The vulnerability is specific to systems running the Network Controller Host Agent service. Server installations without NC Host Agent deployed are not vulnerable. Verify your Server SKU configuration and whether NC components are active in your environment; this flaw does not affect client Windows operating systems or Server editions not explicitly listed.

Exploitability

Exploitability is limited by high privilege barriers. An attacker must have interactive local access and valid user credentials (non-administrative) to trigger the vulnerability. Remote exploitation is not possible. There is no known public exploit or active exploitation in the wild. The CVSS 3.1 score of 5.5 (Medium) reflects these constraints: low attack surface, local vector only, and high privilege requirement. The impact is denial of service only—no confidentiality or integrity breach occurs.

Remediation

Apply the relevant Windows Server security updates released by Microsoft for June 2026 or later. Verify the patch dates against Microsoft's official security bulletin to confirm you are installing the correct build. Additionally, restrict local user access to systems running NC Host Agent to authorized personnel only. Implement network segmentation to reduce the blast radius if local compromise occurs. Monitor for service crashes or restarts of the Network Controller Host Agent service as a potential compromise indicator.

Patch guidance

Consult Microsoft's official security bulletin and KB articles corresponding to the June 2026 release cycle for Windows Server 2019, 2022, and 2025. Patch deployment should be coordinated with change management processes, particularly in production SDN environments where service restart may be required. Test patches in a staging environment first to verify compatibility with existing Network Controller configurations. Verify the patched version explicitly addresses CWE-416 in the NC Host Agent component before deploying to production.

Detection guidance

Monitor Windows Event Viewer for abnormal terminations or hangs of the Network Controller Host Agent service (svchost.exe hosting nchost service). Set up alerting on repeated Service failures within short time windows. Audit local user logons to NC-hosting servers and correlate with NC Host Agent service crashes. Review process execution logs for local user activity preceding service failures. Network teams should also monitor for unexpected network configuration changes or failed policy application, which may indicate service unavailability due to exploitation.

Why prioritize this

While this vulnerability carries a Medium CVSS score, prioritization depends on your infrastructure profile. Organizations with extensive Software Defined Networking deployments, Hyper-V clusters, or cloud-scale environments where NC Host Agent is critical should prioritize this patch within 30 days. Organizations with minimal SDN footprint or no Network Controller deployment can defer patching but should still plan rollout within 60 days as part of regular maintenance cycles. The lack of current wild exploitation reduces urgency, but the availability impact to network management warrants timely remediation.

Risk score, explained

The CVSS 3.1 score of 5.5 (Medium) reflects: local attack vector with low complexity; requirement for user-level privileges; no confidentiality or integrity impact; and high availability impact. The score appropriately weights the denial-of-service nature of the flaw while acknowledging the privilege barrier that limits practical exploitation. However, contextual risk may be higher in SDN-dependent environments where NC unavailability has cascading operational consequences. Assess within your own risk tolerance and network architecture.

Frequently asked questions