EUVD-2026-43995
GHSA-cqjp-pw74-x785
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remote unauthenticated crash of a network-exposed AD FS service with no user interaction (AV:N/AC:L/PR:N/UI:N); impact is availability-only, so C:N/I:N/A:H.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Stack-based buffer overflow in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network.
AnalysisAI
Denial of service in Microsoft Active Directory Federation Services (AD FS) lets a remote, unauthenticated attacker crash the service by triggering a stack-based buffer overflow (CWE-121) over the network. The flaw affects AD FS as shipped across a broad range of Windows client and server builds (Windows 10/11 and Windows Server 2012 through 2025). Microsoft - the reporting party - has released a patch; there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Technical ContextAI
AD FS is Microsoft's on-premises federated identity and single sign-on service that issues security tokens (SAML/WS-Federation/OAuth) to enable cross-organization and cloud authentication, typically exposed to the internet or partner networks to service federation endpoints. The root cause is CWE-121, a stack-based buffer overflow: attacker-influenced input is copied into a fixed-size stack buffer without adequate bounds checking, corrupting the stack and, in this case, terminating the AD FS process. The CPE set covers AD FS components delivered with Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (24H2, 25H2, 26H1), and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025 (including Server Core installations), indicating the vulnerable code is part of the shared AD FS/Windows codebase rather than a single edition. Per the CVSS vector the impact is limited to availability (C:N/I:N/A:H) with an unchanged scope (S:U), consistent with a crash rather than code execution or data disclosure.
RemediationAI
Apply the Microsoft security update for CVE-2026-54983 to all systems running the AD FS role; Microsoft has released a patch, so the primary action is to install the corresponding monthly cumulative/security update for each affected Windows Server or client build as listed in the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54983 (exact fixed build numbers are per-platform in that Update Guide entry - no single fixed version applies across all products). Prioritize internet-facing AD FS servers and the Web Application Proxy tier. Until patching completes, reduce exposure by restricting network reach to AD FS endpoints - limit inbound access to the federation and metadata endpoints to known relying-party and partner IP ranges at the firewall/WAF, and ensure external AD FS access is mediated by the Web Application Proxy rather than exposing the AD FS server directly; the trade-off is that overly tight filtering can break legitimate partner or roaming-user federation, so validate relying-party source ranges before enforcing. Monitor AD FS service health and event logs for unexpected process crashes/restarts as a detection for exploitation attempts.
More in Windows 10 Version 1607
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to run arbitr
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem
Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating
Remote code execution in Microsoft Windows Remote Desktop (RDP) allows an unauthorized network attacker to run arbitrary
Same weakness CWE-121 – Stack-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today