Introduction
A use-after-free vulnerability in the Windows Kernel Mode Driver's NVMe over Fabrics protocol handling lets an authorized attacker achieve remote code execution by sending a malformed response during a connection handshake. The flaw has a CVSS 3.1 base score of 8.0 and sits in kernel space on Windows Server 2025. Storage and infrastructure teams should patch it promptly, even though Microsoft currently rates exploitation as unlikely.
Technical Information
The root cause of CVE-2026-34332 is a use-after-free condition (CWE-416) in the Windows Kernel Mode Driver that handles NVMe over Fabrics (NVMe-oF) protocol communications. The vulnerable component is bound to the network stack, so it can be exploited remotely across one or more network hops.
Attack Flow
Exploitation follows this sequence:
- An attacker with low privileges on the domain sets up a malicious server that can respond to NVMe-oF connection requests.
- The attacker waits for (or socially engineers) a victim user to initiate an NVMe-oF connection to the malicious server.
- During the connection handshake, the attacker's server sends a specially crafted NVMe over Fabrics response message containing an invalid header length value.
- The malformed header length triggers a dangling pointer dereference in the kernel driver, which is the use-after-free condition.
- The attacker achieves arbitrary code execution in kernel context.
CVSS 3.1 Metric Breakdown
| Metric | Value | Description |
|---|---|---|
| Base Score | 8.0 | High severity |
| Attack Vector | Network | Exploitable at the protocol level across network hops |
| Attack Complexity | Low | Repeatable success without specialized access conditions |
| Privileges Required | Low | Attacker needs basic user capabilities |
| User Interaction | Required | Victim must initiate connection to malicious server |
| Confidentiality Impact | High | Full compromise possible |
| Integrity Impact | High | Full compromise possible |
| Availability Impact | High | Full compromise possible |
User interaction is the main limiting factor. The victim must actively connect to a hostile server, so the attacker cannot fire packets at an arbitrary target. That requirement becomes much easier to meet in environments where NVMe-oF storage targets are configured dynamically, or where an attacker can influence DNS or network routing.
Only Windows Server 2025 is affected, which strongly suggests the vulnerable code path was introduced in (or is only reachable through) the NVMe-oF driver stack that ships with that server release.
Patch Information
Microsoft released an official fix for CVE-2026-34332 on May 12, 2026, as part of its regular Patch Tuesday security update cycle. The MSRC advisory marks the remediation level as "Official Fix," meaning a complete vendor solution is available. No official workarounds are listed for interim remediation.
Microsoft shipped the fix in two separate update packages, so administrators can choose how to deploy it:
| Update | Target | Build Number | Reboot Required |
|---|---|---|---|
| KB5087539 | Windows Server 2025 (standard cumulative update) | 26100.32860 | Yes |
| KB5087423 | Windows Server 2025 Datacenter (Azure Edition, Azure Arc connected) | 26100.32772 | No (Hotpatch) |
Both updates share the same servicing stack update prerequisite (KB5089717, SSU version 26100.32837), which Windows Update bundles automatically when you deploy the LCU.
The Hotpatch option in KB5087423 matters most for production workloads running NVMe-oF storage, because those servers can receive the fix without a restart, which keeps disruption low.
The patch almost certainly adds proper validation of the header length field before the kernel driver processes the response buffer. That would prevent the dangling pointer dereference behind the use-after-free condition.
Verifying the Patch
This is a closed-source Windows kernel component, so no public source code diff is available. Administrators can confirm the installed build with winver or with this PowerShell query:
[System.Environment]::OSVersion
Systems running Build 26100.32860 or later (via KB5087539), or Build 26100.32772 or later (via KB5087423), are protected.
Affected Systems and Versions
The vulnerability affects only Windows Server 2025, in both standard and Server Core installations. Many kernel-level CVEs fan out across a broad matrix of Windows versions, but CVE-2026-34332 is confined to the Server 2025 platform.
Affected configurations:
- Windows Server 2025 (standard installation)
- Windows Server 2025 (Server Core installation)
- Windows Server 2025 Datacenter: Azure Edition
Systems that do not run Windows Server 2025 are not affected by this vulnerability.
References
- NVD Entry for CVE-2026-34332
- MSRC Security Update Guide: CVE-2026-34332
- KB5087539: Cumulative Security Update for Windows Server 2025
- KB5087423: Hotpatch Update for Windows Server 2025 Datacenter
- BleepingComputer: Microsoft May 2026 Patch Tuesday fixes 120 flaws, no zero days
- Zero Day Initiative: The May 2026 Security Update Review
- Microsoft MSRC Blog: A note on this month's Patch Tuesday
- Help Net Security: Microsoft May 2026 Patch Tuesday
