CVE-2026-49172

Name of the Vulnerable Software and Affected Versions Windows 10 (affected versions not specified) Windows 11 (affected versions not specified) Windows Server 2019 (affected versions not specified) Windows Server 2022 (affected versions not specified) Windows Server 2025 (affected versions not specified)

Description A heap-based buffer overflow exists in the Windows FTP Service. This flaw allows an unauthorized remote attacker to execute arbitrary code and affect the system over a network. A heap-based buffer overflow occurs when a program writes more data to a heap memory block than it can hold, potentially leading to memory corruption.

Recommendations Update Windows 10 to the July 2026 Patch Tuesday release. Update Windows 11 to the July 2026 Patch Tuesday release. Update Windows Server 2019 to the July 2026 Patch Tuesday release. Update Windows Server 2022 to the July 2026 Patch Tuesday release. Update Windows Server 2025 to the July 2026 Patch Tuesday release.