Windows Active Directory CVE-2026-54115

Exploitation requires the attacker to already hold a low-privileged authenticated account with the ability to execute code locally on an affected Windows system (per PR:L and AV:L), and to reach the vulnerable Active Directory code path that performs the flawed size/length calculation. No user interaction is required (UI:N) and attack complexity is low (AC:L), so once local access is obtained the overflow can be triggered reliably against affected default builds. The limiting factors are that the attack is not remotely exploitable - it cannot be launched over the network without a prior foothold - and it requires valid local authentication, so unauthenticated or purely external attackers cannot exploit it directly; systems already patched with the MSRC update are not affected.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) describes a locally exploitable, low-complexity flaw requiring only low existing privileges and no user interaction, with full CIA impact but no scope change - a classic elevation-of-privilege primitive rather than a remote intrusion vector. No EPSS score and no SSVC decision data were provided in the input, so exploitation probability and automatability cannot be quantified here. It is not in CISA KEV and no POC is referenced, so this is not currently confirmed as actively exploited; the practical priority is driven by its role as a post-compromise escalation step. Because attack vector is local (AV:L), an attacker must already have code execution or an authenticated foothold on the host, which meaningfully limits real-world risk compared to a network-reachable flaw - but on Active Directory infrastructure the reachable impact (potential SYSTEM/domain-relevant control) makes patching worthwhile. No conflicting signals were observed between the vector and description; both point consistently to authenticated local EoP.

An attacker who has already gained a low-privileged authenticated foothold on a Windows host - for example through phishing, a compromised service account, or an initial-access exploit - invokes the vulnerable Active Directory code path with crafted input that triggers the integer overflow. The resulting memory corruption is leveraged to execute code at elevated privilege, giving the attacker full control of the machine. No public POC is referenced, and the local, low-complexity vector means the main barrier is obtaining the initial low-privilege access.