Windows LDAP CVE-2026-34339

The attacker must already possess a low-privileged authenticated local account on the target Windows system (CVSS AV:L, PR:L) - remote unauthenticated exploitation is not possible per the provided vector. The vulnerability is triggered through the Windows LDAP component, which is active by default when LDAP operations are processed, so no non-default configuration is required to reach the vulnerable code. Exploitation is further limited by: (1) requirement for prior local authenticated access, ruling out external attackers without a foothold; (2) impact confined strictly to availability - no code execution, privilege escalation, or data disclosure is achievable; (3) SSVC Automatable: no, meaning reliable at-scale triggering without per-target interaction is not feasible; and (4) scope unchanged (S:U), so a crash is contained to the local LDAP service context without pivoting to other system components.

All available risk signals converge on a low practical priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) confirms exploitation is strictly local, requires only a low-privileged account, and produces no confidentiality or integrity impact - only a service crash. EPSS at 0.04% (11th percentile) reflects statistical models assigning very low probability of exploitation within 30 days. CISA SSVC independently rates exploitation status as 'none,' automatable as 'no,' and technical impact as 'partial,' reinforcing that this is not a candidate for mass or automated exploitation. The vulnerability is absent from the CISA KEV catalog and no proof-of-concept code has been identified. The primary residual concern is insider threat or post-compromise disruption scenarios where an attacker with existing low-privileged access intentionally crashes LDAP-dependent services to impair authentication or group policy processing. For most organizations this is a routine patch-cycle item rather than an emergency priority.

A low-privileged domain user with existing interactive or Remote Desktop Protocol access to a Windows endpoint or server crafts or triggers a specific malformed LDAP operation that causes the Windows LDAP library to dereference a null pointer, crashing the LDAP process and disrupting directory-service-dependent functions such as authentication lookups or group policy application on that host. No public exploit code has been identified, and CISA SSVC rates the flaw as not automatable, making large-scale or opportunistic campaigns implausible at this time.