EUVD-2026-44140
GHSA-c9q6-72fq-24hj
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H
Network-reachable AD service, low complexity, but requires valid low-privileged credentials (PR:L); impact is primarily availability (A:H) with a minor OOB-read confidentiality leak (C:L) and no integrity effect.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Out-of-bounds read in Windows Active Directory allows an authorized attacker to deny service over a network.
AnalysisAI
Denial of service in Windows Active Directory allows an authenticated network attacker to crash or degrade the directory service via an out-of-bounds read (CWE-125). The flaw affects Active Directory across Windows 10 (21H2/22H2), Windows 11 (24H2/25H2/26H1), and Windows Server 2022/2025 including Server Core; there is no public exploit identified at time of analysis. Impact is primarily availability (A:H) with a minor confidentiality leak (C:L), and Microsoft has released a patch.
Technical ContextAI
Active Directory is Microsoft's core enterprise directory and identity service, and the domain controller role handling AD is the reachable network component here. The root cause is CWE-125 (Out-of-bounds Read): the service reads memory outside the bounds of an allocated buffer, typically while parsing an attacker-influenced network request. Such reads can return adjacent memory contents (the C:L confidentiality signal) and, more importantly here, trigger a fault or invalid-state condition that terminates or hangs the service (the A:H availability signal). The CPE set (cpe:2.3:a:microsoft:windows_server_2022, windows_server_2025, windows_server_2025_(server_core_installation), plus Windows 10/11 client builds) indicates the vulnerable AD code ships across both server and client Windows lines. Microsoft's own tags label this both 'Information Disclosure' and 'Buffer Overflow', consistent with an out-of-bounds memory access.
RemediationAI
Patch available per vendor advisory - apply the Microsoft security update referenced at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50682 for each affected Windows and Windows Server build, prioritizing domain controllers first since they run the exposed Active Directory service. The MSRC update guide reference points to Microsoft's update page rather than a single named fix version, so identify the specific KB for your OS build from that advisory (exact patched build numbers are not enumerated in the provided data and should not be assumed). Until patched, reduce exposure by restricting network access to domain-controller LDAP/AD ports (389/636/3268/3269 and RPC) to trusted management subnets and known domain members, and by tightening which accounts can reach DCs - note this compensating control can break legitimate clients or applications that expect broad directory reachability, so validate segmentation against your authentication flows before enforcing it. Because exploitation requires authenticated access (PR:L), also review and prune low-privilege accounts and monitor DCs for abnormal crashes or LSASS/NTDS restarts.
More in Windows 10 Version 21H2
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local privilege escalation in the Windows Kernel lets an already-authenticated attacker corrupt kernel memory via a use-
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Local privilege escalation in the Microsoft Windows Kernel allows an already-authenticated attacker to elevate to SYSTEM
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem
Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating
Remote code execution in Microsoft Windows Remote Desktop (RDP) allows an unauthorized network attacker to run arbitrary
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today