# CVE-2026-42836 — Windows Function Discovery WSD Provider `fdwsd.dll` Unsynchronized `CWSDiscoveryProvider` → Race Condition / Use-After-Free

---

## Summary

| | |
|---|---|
| **Product** | Windows — `fdwsd.dll` (Function Discovery WS-Discovery provider) |
| **CVE ID** | CVE-2026-42836 |
| **Impact** | Elevation of Privilege (to SYSTEM) |
| **MSRC severity** | Important |
| **CVSS** | 7.0 / 6.1 — `CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C` |
| **CWE** | CWE-362: Race Condition → CWE-416: Use After Free |
| **Delivery** | Local — concurrent WSD discovery callbacks vs provider teardown (race) |
| **KB / Fixed build** | KB5094126 — `fdwsd.dll` 10.0.26100.8655 (Win11 24H2 x64) |
| **Patch Date** | June 9, 2026 (2026-Jun) |
| **Pre-patch binary** | `fdwsd.dll` 10.0.26100.8521 — SHA256 `3d81de5e3cc660c5c5af8c21fa1d2659ed8385549bfd1c0524a495a1315096e4` |
| **Post-patch binary** | `fdwsd.dll` 10.0.26100.8655 — SHA256 `11ecb60ad305be2738d5b3b3e821943385ba9bcba00c146b7517f1f9f3d9741d` |
| **Feature flag** | none — direct fix (not CFR-gated) |
| **Exploitability** | Exploitation Less Likely; not publicly disclosed; not exploited (per MSRC) |

---

## Product Description

`fdwsd.dll` implements the **WS-Discovery** provider for the Windows Function
Discovery service. A `CWSDiscoveryProvider` object holds shared provider state —
including a client **certificate context** and discovery members — and the service
invokes its callbacks (`IsInterestedInDevice`, `IsInterestedInMex`) as
network-triggered discovery events arrive.

---

## Vulnerability Summary

Pre-patch, access to a `CWSDiscoveryProvider`'s shared state was **not
synchronized**. A discovery callback could read/use the provider's state (or its
certificate context) concurrently with another thread modifying it, or with the
provider being **destroyed** — a race (CWE-362) that leaves a callback using freed
provider state / a freed certificate, i.e. a use-after-free (CWE-416). Because the
service runs with high privilege (SYSTEM/LocalService) and the provider is driven by
discovery events, winning the race (`AC:H`) is a local elevation-of-privilege
primitive to SYSTEM (per the MSRC FAQ).

---

## Prerequisites and Constraints

- Local, low-privileged (`PR:L`, `AV:L`); `AC:H` — must win the race between
  discovery-callback use and provider teardown/modification.
- Result: a callback operates on freed `CWSDiscoveryProvider` state / certificate.

---

## Vulnerability Details

### Root Cause

`CWSDiscoveryProvider`'s shared state (and the client certificate context it handed
out) had no lock, so concurrent discovery callbacks and the destructor could access
/ free it simultaneously.

### The patch (confirmed — diff, .8521 → .8655)

`CWSDiscoveryProvider` gains a **`CRITICAL_SECTION` at object offset `+0x128`**, and
the teardown and callbacks now serialize on it; `GetClientCertificate` additionally
hands out a **private duplicate** of the certificate instead of the shared pointer:

```c
// ~CWSDiscoveryProvider (10.0.26100.8655) — PATCHED (from our diff)
EnterCriticalSection((LPCRITICAL_SECTION)(this + 0x128));
*(undefined8 *)(this + 0x98) = 0;                 // clear shared member under the lock
LeaveCriticalSection((LPCRITICAL_SECTION)(this + 0x128));

// IsInterestedInDevice / IsInterestedInMex — access shared state under the lock:
EnterCriticalSection((LPCRITICAL_SECTION)(this + 0x128));
... /* evaluate discovery event against shared state */ ...
LeaveCriticalSection((LPCRITICAL_SECTION)(this + 0x128));

// GetClientCertificate — return a private reference, under the lock:
// CertDuplicateCertificateContext(...)   // caller gets its own copy
```

Serializing teardown and callback access with the critical section, and duplicating
the certificate for callers, ensures the shared object/certificate cannot be freed
while another path is using it, closing the race and the resulting use-after-free.

### Patch Completeness Assessment

Fixed in `fdwsd.dll` 10.0.26100.8655 (June 2026). Apply KB5094126. The
synchronization runs unconditionally (no feature flag to verify).

---

## Detection Guidance

**Behavioural.** Rapid WS-Discovery activity that races Function Discovery provider
setup/teardown; use-after-free / heap-corruption crashes in
`fdwsd!CWSDiscoveryProvider::IsInterestedInDevice` / `~CWSDiscoveryProvider` /
`GetClientCertificate` on unpatched builds.

---

## References

- MSRC advisory — CVE-2026-42836 (Function Discovery Service Elevation of Privilege), released 2026-06-09, KB5094126.
- Full binary diff: `/data/patch_diffs/fdwsd_dll-cve-2026-42836-ghidriff.md`