Active Directory CVE-2026-49164

Exploitation requires network reachability to a Windows domain controller running the Active Directory Domain Services role and the ability to reach the vulnerable AD DS protocol handler; per the CVSS vector (PR:N, UI:N) no authentication or user interaction is needed. The key limiting factor is AC:H - the attacker must satisfy conditions outside their direct control, consistent with a heap overflow that depends on specific memory layout, allocation state, or a timing race, so exploitation is not guaranteed on a single attempt and is substantially harder than a low-complexity network flaw. Practical risk is further limited to environments where domain controllers are network-reachable by the attacker; DCs isolated to trusted management/replication networks materially reduce exposure.

The signals are mixed and should be weighed rather than taken at face value. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, score 8.1) describes a remotely reachable, unauthenticated flaw with full triad impact, which on a domain controller is inherently high-value. The mitigating factor is AC:H - successful exploitation depends on conditions outside the attacker's control (such as winning a memory/timing race or achieving a specific heap state), which is why the score lands at 8.1 rather than the ~9.8 a low-complexity equivalent would score. No EPSS score, KEV listing, or POC was provided, so real-world exploitation probability cannot be quantified from the input; the absence of KEV means there is no evidence of active exploitation, and the absence of a POC reference means no public exploit is confirmed. Net assessment: this is a genuine high priority because the target is domain controllers and the vector is unauthenticated, but the high complexity and lack of any exploitation evidence suggest it is not a mass-exploitation event - patch promptly on a normal-to-expedited cycle rather than as an emergency.

An attacker with network access to a domain controller sends a specially crafted request to an AD DS protocol endpoint that triggers the heap-based buffer overflow, corrupting memory in the directory service process. By carefully shaping the heap and repeating the attempt to satisfy the high-complexity timing/state conditions, the attacker achieves arbitrary code execution in the context of AD DS, effectively compromising the domain controller. No public exploit code was identified at time of analysis.