EUVD-2026-43996
GHSA-gcv2-qw2g-r29w
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remotely reachable AD FS listener needs no auth or interaction (AV:N/AC:L/PR:N/UI:N); a stack overflow crashes the service, so availability-only impact (A:H, C:N/I:N).
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Stack-based buffer overflow in Active Directory Federation Services allows an unauthorized attacker to deny service over a network.
AnalysisAI
Denial of service in Microsoft Active Directory Federation Services (AD FS) allows a remote, unauthenticated attacker to crash the service by triggering a stack-based buffer overflow over the network (CVSS 7.5, availability-only impact). Because AD FS brokers single sign-on and federated authentication, a successful attack can knock out login for every downstream application that relies on it. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Technical ContextAI
The flaw is a stack-based buffer overflow (CWE-121), a memory-safety defect in which network-supplied data is copied into a fixed-size stack buffer without adequate bounds checking, corrupting the stack. It resides in AD FS, the Windows role that provides claims-based federated identity and single sign-on (SAML/WS-Federation/OAuth) across organizational boundaries. The affected CPE and tag data enumerate the full Windows Server line that can host the AD FS role - Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025 (including Server Core installations) - while the additional Windows 10/11 client CPEs reflect Microsoft's shared servicing-stack update packaging rather than the client OS itself running AD FS. While CWE-121 buffer overflows can sometimes yield code execution, the CVSS vector here scores only availability impact (C:N/I:N/A:H), indicating the practical outcome is a service crash rather than compromise.
RemediationAI
Apply the Microsoft security update for CVE-2026-50695 as delivered through the monthly cumulative update for each affected Windows Server version; Patch available per vendor advisory (an exact fixed build number is not specified in the provided data, so obtain the precise KB from the MSRC update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50695). As compensating controls until patching completes, restrict network reachability to the AD FS and Web Application Proxy endpoints - limit the federation service to trusted networks, place it behind the Web Application Proxy rather than exposing the AD FS servers directly, and use firewall rules or extranet smart lockout/geo-filtering to reduce the pool of hosts that can reach the vulnerable listener; the trade-off is that overly aggressive filtering can break legitimate external federated logins, so scope rules to known partner and client ranges. Ensure AD FS server redundancy (farm nodes behind a load balancer) so a single crashed node does not eliminate authentication availability.
More in Windows 10 Version 1607
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to run arbitr
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem
Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating
Remote code execution in Microsoft Windows Remote Desktop (RDP) allows an unauthorized network attacker to run arbitrary
Same weakness CWE-121 – Stack-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today