EUVD-2026-43976
GHSA-p6w8-298r-9237
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Remotely reachable and unauthenticated (AV:N/PR:N/UI:N) but heap-overflow exploitation depends on memory state/timing outside attacker control (AC:H); code execution on a DC yields full C:H/I:H/A:H.
Primary rating from Vendor (microsoft).
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
Heap-based buffer overflow in Active Directory Domain Services allows an unauthorized attacker to execute code over a network.
AnalysisAI
Remote code execution in Microsoft Active Directory Domain Services (AD DS) allows an unauthenticated network attacker to corrupt heap memory and run arbitrary code on affected domain controllers. The flaw (CVE-2026-49164, CVSS 8.1) spans a broad range of Windows client and server builds from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025, with full confidentiality, integrity, and availability impact. Microsoft has released a patch; there is no public exploit identified at time of analysis, and the high attack complexity (AC:H) tempers the practical exploitation likelihood.
Technical ContextAI
The vulnerability is a CWE-122 heap-based buffer overflow within Active Directory Domain Services, the directory and authentication backbone that runs on Windows domain controllers and underpins Kerberos/LDAP authentication, group policy, and identity management across enterprise Windows networks. A heap overflow occurs when code writes past the bounds of a dynamically allocated buffer, corrupting adjacent heap metadata or object pointers; when reachable through a network-facing AD DS protocol handler, a crafted request can overwrite memory in a way that redirects execution. The affected CPE set covers the AD DS role as shipped across Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (24H2, 25H2, 26H1), and Windows Server 2012 through 2025, indicating a long-standing code path shared across many Windows builds rather than a regression in a single recent release.
RemediationAI
Apply the Microsoft security update for CVE-2026-49164 as the primary and authoritative fix - Patch available per vendor advisory; obtain the exact per-build KB and patched version from the Microsoft Security Response Center guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49164 and deploy it to all domain controllers and affected Windows systems first, prioritizing broadly reachable DCs. Because no exact fix version string was included in the input, pull the specific cumulative update / KB number for each OS version directly from the MSRC page rather than assuming one. As compensating controls until patching completes, restrict network reachability of domain controllers by limiting AD DS protocol traffic (LDAP/Kerberos and related RPC endpoints) to trusted management networks and blocking exposure from untrusted segments and the internet, and increase monitoring on DCs for anomalous crashes or AD/LSASS service restarts that could indicate exploitation attempts; note the trade-off that tightening DC network access can disrupt legitimate authentication and replication if scoped too aggressively, so validate segmentation against replication and client-auth paths before enforcing.
More in Windows Server 2012
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Remote code execution in Microsoft Office 2007-2016 and Windows Vista through 10 allows attackers to execute arbitrary c
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Active Directory Domain Services Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.5), this vulnerabilit
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today