EUVD-2026-43761
GHSA-2q6g-jrff-pxhq
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attacker requires low-privilege domain authentication to reach AD DS over network; crash impact is availability-only with no confidentiality or integrity consequence.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Null pointer dereference in Active Directory Domain Services allows an authorized attacker to deny service over a network.
AnalysisAI
Null pointer dereference in Windows Active Directory Domain Services (AD DS) enables a low-privileged authenticated attacker to crash the service remotely, causing denial of service across the affected domain. The flaw spans a wide range of Windows client and server releases, from Windows 10 version 1607 through Windows 11 version 26H1 and Windows Server 2012 through 2025. No public exploit code has been identified and this vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog at time of analysis, though the network-accessible attack surface and low privilege requirement lower the bar for abuse in environments with broad domain user access.
Technical ContextAI
CWE-476 (Null Pointer Dereference) describes a class of bug where code dereferences a pointer expected to be valid but which is NULL, causing an unhandled exception and typically a process crash. In Active Directory Domain Services - the Windows implementation of LDAP-based directory services used for authentication, authorization, and policy enforcement across Windows domains - a crafted request can trigger this condition in the AD DS service process. The CPE data identifies affected products spanning cpe:2.3:a:microsoft:windows_10_version_1607 through cpe:2.3:a:microsoft:windows_server_2012_r2 and additional server releases tagged in the advisory, indicating the vulnerable code path exists across both client OS builds (where AD DS roles may be present) and all major Windows Server generations. The network-accessible AD DS interface most commonly manifests over LDAP (TCP 389/636) or Kerberos-related protocols, meaning any authenticated network client can potentially reach the vulnerable component.
RemediationAI
Microsoft has released a patch for this vulnerability; apply the relevant cumulative update for each affected Windows version as detailed in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57976. An exact fixed build version was not specified in the available data - consult the advisory directly to identify the minimum patched cumulative update for each OS version in use. Patch available per vendor advisory. Until patching is complete, organizations can reduce exposure by restricting which authenticated accounts can reach domain controller LDAP ports (TCP 389/636, TCP 3268/3269) at the network layer, noting that overly restrictive firewall rules on domain controllers may disrupt legitimate Kerberos and LDAP traffic and should be tested carefully before deployment. Segregating high-value domain controllers behind network access controls to limit which user segments can initiate sessions against them reduces the pool of potential attackers without requiring a patch rollout.
More in Windows 10 Version 1607
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to run arbitr
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem
Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating
Remote code execution in Microsoft Windows Remote Desktop (RDP) allows an unauthorized network attacker to run arbitrary
Same weakness CWE-476 – NULL Pointer Dereference
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today