CVE-2026-32087

What it actually does

CVE-2026-32087 is a local privilege escalation vulnerability caused by a heap-based buffer overflow in Windows Function Discovery Service code, specifically fdwsd.dll. A low-privileged authenticated user can trigger memory corruption through Function Discovery-related functionality and potentially gain code execution in the security context of the vulnerable service. Successful exploitation can allow the attacker to bypass normal privilege boundaries and obtain elevated access with high confidentiality, integrity, and availability impact on the local system. The CVSS vector indicates local access is required, user interaction is not required, privileges are required, and exploitation complexity is high, meaning reliable exploitation likely depends on precise heap manipulation and target-specific conditions.

Why it matters to the business

This vulnerability can turn an ordinary compromised user account on a Windows workstation or server into a full system compromise, enabling data theft, security control tampering, persistence, and lateral movement. It is especially relevant as a second-stage vulnerability after phishing, stolen credentials, or malware execution because it helps an attacker move from initial access to administrative control. The issue affects a broad range of supported Windows client and server versions, including Windows 10, Windows 11, Windows Server 2012, 2016, 2019, 2022, and 2025, so enterprise exposure may be widespread. It is not currently listed in CISA KEV, is not marked as ransomware-used, has low EPSS, and has no public exploit maturity reported, but it has been public for 120 days, so unpatched systems should still be treated as avoidable privilege-escalation risk.

How an attack unfolds

An attacker first needs local authenticated access to a vulnerable Windows system, usually through a compromised low-privileged account, malware foothold, or interactive access. The attacker then interacts with Function Discovery components that load or exercise fdwsd.dll, supplying malformed input or invoking service behavior that causes a heap-based buffer overflow. If the attacker can shape heap memory reliably, the overflow can corrupt control data or adjacent heap structures and redirect execution flow inside the service process. The exploit payload then runs with the privileges of the affected service context, allowing the attacker to elevate privileges, disable protections, dump credentials, install persistence, or launch additional tools for lateral movement. Because exploitation complexity is high and no mature public exploit is reported, attacks may be noisy during development or failed attempts, including service crashes, Windows Error Reporting events, and abnormal child processes from service-hosting processes.

How to fix it

Apply the Microsoft security update that addresses CVE-2026-32087 for each affected Windows version. Because no exact fixed build numbers were provided in the input, use Microsoft Security Update Guide, Windows Update, WSUS, Microsoft Configuration Manager, or an equivalent patch-management platform to deploy the April 2026 or later cumulative security update applicable to each affected product. Prioritize internet-facing administration systems, shared workstations, jump hosts, domain administration workstations, and servers where low-privileged users can log on. If immediate patching is not possible, reduce local logon rights, restrict unnecessary interactive access to servers, monitor Function Discovery-related service instability, and enforce endpoint controls that prevent untrusted local code execution. Avoid disabling core Windows discovery services broadly unless tested, as doing so may affect device discovery, network discovery, or dependent operational workflows.

How to confirm the fix worked

Confirm remediation by verifying that affected Windows systems have the relevant April 2026 or later cumulative security update installed for their specific OS release. Validate through Windows Update history, Get-HotFix, WSUS or Configuration Manager compliance reports, Microsoft Defender Vulnerability Management, or other endpoint vulnerability scanners. Check the installed fdwsd.dll file version and timestamp against Microsoft’s patched baseline for the exact Windows build. Perform authenticated vulnerability scanning to confirm the host is no longer reported as vulnerable. For mitigation validation, confirm local interactive logon rights are limited, standard users cannot execute unapproved tooling, and monitoring is enabled for service crashes, abnormal svchost.exe behavior, and suspicious child processes spawned from service-hosting contexts.

Typical attack path

1. Gain local authenticated access to a vulnerable Windows workstation or server using a low-privileged account or malware foothold.
2. Enumerate the Windows build and confirm Function Discovery components and fdwsd.dll are present and unpatched.
3. Trigger Function Discovery Service behavior using crafted local input or service/API interaction designed to reach the vulnerable heap allocation path.
4. Manipulate heap layout to make the buffer overflow reliable and corrupt memory in a controlled way.
5. Redirect execution flow and run attacker-controlled code in the service context.
6. Use the elevated context to create an administrator-level process, modify security settings, dump credentials, or install persistence.
7. Perform follow-on actions such as lateral movement, defense evasion, or data access.

How to detect it

Look for evidence of attempted or successful local privilege escalation around Function Discovery components. Relevant log sources include Windows Security logs, System logs, Application logs, Windows Error Reporting, Sysmon or EDR telemetry, PowerShell logs, service control logs, and endpoint crash-dump repositories. Investigate Application Error or Windows Error Reporting events where fdwsd.dll is the faulting module, especially if followed by new elevated processes, new services, account changes, security tool tampering, credential access, or lateral movement. In Security logs, review process creation events such as 4688 for suspicious child processes launched by svchost.exe or service-hosting contexts, especially cmd.exe, powershell.exe, rundll32.exe, regsvr32.exe, mshta.exe, wscript.exe, cscript.exe, certutil.exe, or unknown binaries. In System logs, review service crash or restart events such as Service Control Manager 7031, 7034, and 7036 involving Function Discovery-related services. In Sysmon, review Event ID 1 for suspicious process creation, Event ID 7 for unusual fdwsd.dll loading paths, Event ID 10 for credential-access behavior after suspected escalation, and Event ID 11 for creation of unexpected executables or persistence artifacts. Since no public mature exploit is reported, there are no known exploit-specific network signatures; detection should focus on local crash indicators, service-hosted process anomalies, and post-exploitation behavior.

• fdwsd.dll
• Faulting module name: fdwsd.dll
• Function Discovery Provider Host
• Function Discovery Resource Publication
• fdPHost
• FDResPub
• Service Control Manager
• Event ID 7031
• Event ID 7034
• svchost.exe
• svchost.exe -k LocalService
• svchost.exe -k LocalServiceNetworkRestricted
• cmd.exe spawned by svchost.exe
• powershell.exe spawned by svchost.exe
• rundll32.exe spawned by svchost.exe
• regsvr32.exe spawned by svchost.exe
• mshta.exe spawned by svchost.exe
• wscript.exe spawned by svchost.exe
• cscript.exe spawned by svchost.exe
• certutil.exe spawned by svchost.exe
• Fault bucket
• Application Error
• Windows Error Reporting

What your security team should do

• Patch all affected Windows client and server versions with the applicable Microsoft cumulative security update; prioritize systems allowing broad local or remote interactive logon.
• Use asset inventory to identify Windows 10, Windows 11, Windows Server 2012, 2016, 2019, 2022, and 2025 systems that have not received April 2026 or later security updates.
• Treat this primarily as a post-compromise privilege-escalation risk and pair patching with controls that limit initial footholds, including application control, EDR, phishing resistance, and least privilege.
• Review endpoint telemetry for Function Discovery service crashes, Windows Error Reporting events referencing fdwsd.dll, and suspicious child processes launched from svchost.exe.
• Restrict local administrator membership and remove unnecessary local logon rights from standard users on servers and high-value workstations.
• Harden credential exposure controls such as LSASS protection, Credential Guard where supported, and tamper protection to reduce the value of successful privilege escalation.
• Create SIEM detections for service-hosted processes spawning shells, credential tools, scripting engines, or unsigned binaries shortly after fdwsd.dll-related crashes.
• Monitor vendor advisories for any change in exploit maturity, KEV status, ransomware use, or newly released proof-of-concept exploit code.