# CVE-2026-0386 — Windows Deployment Services `WdsImgSrv.dll` Unauthenticated Unattend File Disclosure over RPC (`HandlerClientUnattend` / `WdsProviderInitialize`)

---

## Summary

| | |
|---|---|
| **Product** | Windows Server — `WdsImgSrv.dll` (Windows Deployment Services image server / unattend handler) |
| **CVE ID** | CVE-2026-0386 |
| **Impact** | Remote Code Execution (MSRC) — in practice, sensitive-config disclosure enabling compromise |
| **MSRC severity** | Important |
| **CVSS** | 7.5 / 6.5 — `CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C` |
| **CWE** | CWE-73: External Control of File Name or Path |
| **Delivery** | Adjacent network (`AV:A`) — unauthenticated WDS RPC; MITM / client impersonation on the same LAN |
| **KB / Fixed build** | KB5073722 — `WdsImgSrv.dll` 10.0.14393.8783 (Windows Server 2016); also fixed on Server 2019/2022/2025 |
| **Patch Date** | January 13, 2026 (2026-Jan) |
| **Pre-patch binary** | `WdsImgSrv.dll` 10.0.14393.8781 — SHA256 `cf32b6fa785515829954b709cdf86ceaff4d1365ff6b2329f4b3f61fa5362e4b` |
| **Post-patch binary** | `WdsImgSrv.dll` 10.0.14393.8864 — SHA256 `dbb20ac921e2932422ca4c6d86109f86d3d42d79e1e742a977ed97df00f87ebb` |
| **Exploitability** | Exploitation Less Likely; not publicly disclosed; not exploited (per MSRC) |

---

## Product Description

Windows Deployment Services (WDS) network-installs operating systems. It can use
an **`unattend.xml`** answer file to automate sensitive settings — local
administrator password, domain-join credentials, product keys — during
"hands-free" deployment. `WdsImgSrv.dll` is the WDS image-server provider that
serves these files to clients. The relevant handler, `HandlerClientUnattend`,
answers client requests for the unattend file over the WDS **RPC** channel.

---

## Vulnerability Summary

WDS served the unattend answer file to clients over an **unauthenticated RPC
channel**. Pre-patch, `HandlerClientUnattend` looked up and transmitted the
unattended-install file in response to a client request **without any policy or
authentication check** on the channel. An attacker with adjacent-network access
(same LAN) could therefore obtain the file by **man-in-the-middle** on the
client↔server path or by **impersonating a legitimate client**, and read the
sensitive configuration — including administrator credentials — in **plaintext**
(CWE-73: external control of file name/path over an untrusted channel).

---

## Prerequisites and Constraints

- Adjacent network (`AV:A`), no privileges (`PR:N`); `AC:H` reflects the
  MITM/impersonation timing/positioning required.
- A WDS server configured for hands-free / unattended deployment that transmits
  `unattend.xml` over the legacy unauthenticated RPC path.
- Result: disclosure of plaintext deployment secrets (admin password, domain
  join), which enables downstream compromise (the RCE rating).

---

## Vulnerability Details

### Root Cause

The unattend-file transmission path trusted the unauthenticated RPC request and
returned the answer file with no gating on whether the channel/settings are
secure — so a network-positioned attacker receives the plaintext file.

### The patch (confirmed — diff, .8781 → .8864)

The patch adds a **registry-driven policy check** before the file is served,
wired into `WdsProviderInitialize` and `HandlerClientUnattend` via a new
evaluation routine (`EvaluateCurrentStateFromRegistry` → `EvaluateCurrentState`
/ `EvaluateFeature`). It reads a value under:

```
HKLM\System\CurrentControlSet\Services\WdsServer\Providers\WdsImgSrv\Unattend
    AllowHandsFreeFunctionality   (REG_DWORD)
```

confirmed in the diff by the newly added `RegOpenKeyExW(HKLM, ...)` /
`RegQueryValueExW` calls and the value/key strings in the patched binary. Two
outcomes:

1. **Admin has explicitly allowed the insecure setting** (`AllowHandsFreeFunctionality`
   enabled): the server does **not** block, but emits a warning log — *"This
   system is using insecure settings for Windows Deployment Services. This may
   expose sensitive configuration files to interception…"* (fwlink 2344403) — and
   proceeds with the legacy behaviour.
2. **Setting not present / insecure channel:** the request is **rejected** and the
   unattend file is not transmitted.

Microsoft has also announced phasing out the unauthenticated hands-free
deployment feature: after a mid-2026 update the protection is enabled by default,
blocking hands-free deployment over unauthenticated RPC unless manually
re-enabled, and steering admins to boot.wim-based or authenticated-RPC
deployment.

---

## Detection Guidance

**Behavioural.** WDS servers transmitting `unattend.xml` over unauthenticated RPC;
clients on the deployment VLAN requesting the unattend file; the WDS warning event
about "insecure settings … exposed to interception".

**Config.** Check
`HKLM\System\CurrentControlSet\Services\WdsServer\Providers\WdsImgSrv\Unattend\AllowHandsFreeFunctionality`
— if the insecure hands-free path is enabled, the server still serves the file
(with a warning). Prefer authenticated RPC / boot.wim-based deployment.

---

## References

- MSRC advisory — CVE-2026-0386 (Windows Deployment Services Remote Code Execution), released 2026-01-13, KB5073722.
- Full binary diff: `/data/patch_diffs/wdsimgsrv_dll-cve-2026-0386-ghidriff.md`