Description

Heap-based buffer overflow in Windows iSCSI Target Service allows an unauthorized attacker to deny service over a network.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.9",
  "pubDate": "2026-08-11T17:18:59.590Z",
  "pubdate": "2026-08-11T17:18:59.590Z",
  "executiveSummary": "A vulnerability categorized as a heap-based buffer overflow exists within the Windows iSCSI Target Service. This security flaw enables an unauthorized remote attacker to cause a denial of service condition over the network against targeted systems.\nThe affected product is the Windows iSCSI Target Service, which handles Internet Small Computer Systems Interface (iSCSI) communications and storage management.\nThe risk implications are significant for environments utilizing the iSCSI target role, as successful exploitation disrupts storage accessibility and overall system availability without requiring user interaction.\nAn unauthenticated attacker with network access to the listening iSCSI service can exploit this vulnerability by transmitting maliciously crafted network traffic designed to trigger memory corruption within the heap.\nNo specific exploitation requirements beyond network connectivity to the vulnerable service are indicated in the vulnerability description.",
  "technicalDetails": "The vulnerability resides in the heap management logic of the Windows iSCSI Target Service, specifically within the component responsible for parsing incoming iSCSI protocol data units over the network.\nThe root cause is a heap-based buffer overflow, stemming from insufficient bounds checking or improper size validation when allocating and writing data to dynamically allocated heap memory buffers during packet processing.\nExploitation occurs when an unauthorized attacker transmits a specially crafted network payload directed at the listening port of the Windows iSCSI Target Service. Upon receiving the malformed request, the vulnerable function miscalculates the required buffer size or fails to restrict the quantity of input data copied into the heap buffer.\nThe attack flow proceeds as follows: First, the attacker establishes a network connection to the Windows iSCSI Target Service. Second, the attacker sends the malicious sequence of bytes encapsulated within iSCSI protocol traffic. Third, the parsing routine processes the input and writes past the allocated boundaries of the heap buffer, corrupting adjacent heap metadata and adjacent memory structures.\nThis memory corruption results in an immediate crash or abnormal termination of the Windows iSCSI Target Service, precipitating a denial of service condition for dependent storage resources.\nAuthentication and privilege requirements are minimal; the vulnerability can be exploited by an unauthorized attacker over the network. The network exposure is dictated by the accessibility of the iSCSI service listening port.\nThe post-exploitation impact described is strictly limited to a denial of service, compromising the availability pillar of the CIA triad for the affected storage infrastructure."
}