# Windows Server DFS Zero-Day Denial of Service via Malformed DFS_REFERRAL_V3 (CVE-2026-70111)

> CVE-2026-70111 is a missing length check in the Windows kernel driver mup.sys that lets a malformed DFS_REFERRAL_V3 NameList referral trigger a kernel null-pointer dereference and an immediate BSOD on Windows Server 2019, 2022 and 2025. Exploitation needs a rogue SMB server and a coerced victim connection, with no privileges. Microsoft patched it in the October 2026 updates, and no active exploitation was observed at disclosure.

- **Published:** 2026-10-14T10:31:04Z
- **Last reviewed:** 2026-10-16T01:24:41.985Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3491
- **ID:** TL-2026-3491
- **Severity:** HIGH (CVSS 8.1)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 8 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-70111

## Description

Corelight disclosed CVE-2026-70111 on 2026-10-13, the same day Microsoft shipped the fix in its October 2026 updates. The researchers found it while testing Microsoft RPC interfaces and DFS APIs, and Corelight describes the finding as fuzzing-derived.

Root cause: the mup.sys function PktExpandSpecialEntryFromReferral() handles DFS referral entries whose ReferralEntryFlags field has the 0x0002 (NameList referral) bit set. It uses ExpandedNameOffset to locate a domain controller name and calls wcslen() on the resulting pointer. Earlier Windows builds checked that the expanded name held at least one character. The affected Server builds lack that guard, a length check that was removed. A DFS_REFERRAL_V3 response whose ExpandedNameOffset points at an empty WCHAR string (0x00 0x00) therefore reaches unsafe processing and causes a kernel null-pointer dereference. The related weakness is NULL pointer dereference (CWE-476) with insufficient input validation; the sources do not state a CWE, so this is an analyst mapping. Windows 10 is not affected because it retains the check.

Attack flow: the attacker runs a rogue SMB server and coerces the target Windows Server into connecting and requesting a DFS referral. The rogue server returns the crafted DFS_REFERRAL_V3 payload and the target crashes within seconds. No administrative privileges and no domain controller compromise are needed. Corelight reports 11/11 reproductions on Server 2022 and 3/3 on Server 2019. The crash can be repeated against the same target for sustained denial of service. Corelight references the NetDFS management interface (MS-DFSNM, UUID 4fc742e0-4a10-11cf-8273-00aa004ae673) in its analysis. The impact is availability only: no code execution or data disclosure is reported.

Status: neither source reports active exploitation. No formal public PoC was released, but the exploitation method is described publicly. Neither source states a CVSS score, so cvss_score is null; the MEDIUM severity is an analyst estimate for a DoS-only impact, not a source-stated value. CISA KEV did not list the CVE as of this research.

Detection: Corelight Feed ships Suricata signatures for malformed DFS_REFERRAL_V3 packets. In Zeek conn.log, clusters of conn_state S1, RSTR or RSTRH from the same server can indicate exploitation attempts. After a crash, Windows System log shows Event ID 41 (Kernel-Power) and Event ID 6008 (unexpected shutdown), and typically no minidump or clear crash reason is recorded. Corelight advises prioritizing patches for DFS-active servers and monitoring internal SMB2 traffic rather than relying on perimeter visibility.

## MITRE ATT&CK

- T1499.004 Endpoint Denial of Service: Application or System Exploitation
- T1529 System Shutdown/Reboot
- T1021.002 Remote Services: SMB/Windows Admin Shares
- T1187 Forced Authentication
- T1499 Endpoint Denial of Service
- T1210 Exploitation of Remote Services

## Sources

- [One-Packet Windows Server DoS via DFS (CVE-2026-70111)](https://corelight.com/blog/cve-2026-70111-microsoft-distributed-file-system-0-day)
- [Windows Server Zero-Day Flaw Lets Attackers Crash Servers With a Single Malicious Packet](https://gbhackers.com/windows-server-zero-day-flaw/)
- [MSRC Security Update Guide: CVE-2026-70111](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70111)
- [NVD: CVE-2026-70111](https://nvd.nist.gov/vuln/detail/CVE-2026-70111)
- [CISA Known Exploited Vulnerabilities Catalog (CVE not listed at research time)](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [MS-DFSNM: Distributed File System (DFS): Namespace Management Protocol](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dfsnm/95a506a8-cae6-4c42-b19d-9c1ed1223a62)
- [MS-DFSC: DFS Referral Protocol (DFS_REFERRAL_V3 structure)](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dfsc/3109f4be-dbd0-4e4f-8a54-8a5c5e2e2e47)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3491