CVE-2026-97830
7.5HighPublished 13 Oct 2026 · NVD status: Analyzed · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on availability
- Weakness
- CWE-415
Impact
Remote, unauthenticated attackers can crash IIS and cause a denial of service across the network. No credentials or user interaction are required.
Root cause
A double-free vulnerability in Windows Internet Information Services (IIS) corrupts memory when handling network requests.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Fix & remediation
Install the corresponding Microsoft security update from the vendor advisory. If patching cannot happen immediately, restrict or block inbound network traffic to IIS ports (typically TCP 80 and 443) to trusted IPs.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Double free in Windows Internet Information Services allows an unauthorized attacker to deny service over a network.