EUVD-2026-100480
GHSA-mpf7-rw4x-66w7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain local privileged access
-
ExploitSupply malformed serialized credential buffer
-
ExecutionTrigger out-of-bounds memory read
-
ImpactLeak adjacent process memory into system logs
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Exploitation requires the ability to deliver a malformed serialized credential buffer to the Okta Credential Provider for Windows so that it is parsed as a Kerberos logon structure, which per PR:H and AV:L demands pre-existing high-privilege LOCAL access on the host - not remote or unauthenticated access. Affected deployments are Okta Credential Provider for Windows versions before 1.4.6.0. Limiting factors that reduce realistic risk: local-only attack surface (no network reachability), the high privilege requirement, and the fact that a patched release (1.4.6.0) is available; the primary demonstrated outcome is disclosure of adjacent process memory into local system logs plus possible crash of the provider process. |
| Impact | This is a moderate-severity, local-privilege issue rather than a mass-exploitation priority. The provided CVSS 3.1 vector (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N, base 6.0) shows a LOCAL attack vector requiring HIGH privileges (PR:H) - meaning the attacker must already hold elevated local access before they can feed a malformed serialized credential buffer to the Okta Credential Provider. That precondition sharply limits real-world risk despite the C:H/I:H impact ratings. No EPSS score, no CISA KEV listing, and no public exploit code were provided, so there is no signal of active or probable exploitation; exploitation status is 'no public exploit identified at time of analysis.' SSVC-style reasoning: exploitation=none observed, automatable=no (requires local privileged access and a crafted structure), technical impact=partial-to-total but gated behind privilege. One internal inconsistency to flag: the vendor scored A:N, yet the description explicitly states the credential provider process can 'terminate unexpectedly,' which is an availability impact - the A:N rating appears to understate a denial-of-service outcome and should be verified with Okta. Overall this is a high-CVSS-impact-but-low-real-world-risk item suitable for routine patching, not emergency response. |
| Exploit ScenarioDerived | No public exploit is identified. A local attacker who already possesses high privileges on a Windows host running the Okta Credential Provider supplies a malformed serialized credential buffer that the provider interprets as a Kerberos logon structure without validating its size or packed string offsets. The resulting out-of-bounds read leaks adjacent process memory into local system logs, while an out-of-bounds write or unchecked offset can crash the provider process; because the vector is local with PR:H, exploitation is confined to an already-privileged foothold. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Improper input validation in the Okta Credential Provider for Windows (versions before 1.4.6.0) allows a locally authenticated, high-privilege attacker to feed a malformed serialized credential buffer that the provider parses as a Kerberos logon structure without validating buffer size or packed string offsets, resulting in out-of-bounds memory reads and writes, provider process termination, and potential disclosure of adjacent process memory into local system logs. Because the CVSS vector is AV:L/PR:H/UI:N, exploitation requires pre-existing high-privilege local access on the host rather than remote or unauthenticated reach, and the primary demonstrated outcome is memory disclosure into logs plus a possible crash, not code execution. There is currently no public exploit code identified at time of analysis and no confirmed active exploitation (CISA KEV); a vendor-released patch (1.4.6.0) is available, which together with the local-only, high-privilege prerequisites makes this a moderate-severity hygiene and hardening issue rather than a mass-exploitation priority.
RemediationAI
Upgrade to the vendor-released fixed build, Okta Credential Provider for Windows 1.4.6.0 or later, and verify the deployed provider version on every endpoint rather than relying on the installer alone; full details are in Okta's advisory at https://trust.okta.com/security-advisories/improper-input-validation-in-the-okta-credential-provider-for-windows-cve-2026-78628 (cross-referenced by the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-78628). Because exploitation requires high-privilege local access (AV:L/PR:H) and the demonstrated impact is memory disclosure plus a possible provider crash, the practical compensating controls are those that reduce who and what can reach the parsing path: enforce least privilege so that local administrator rights are not broadly granted (this removes the PR:H precondition, at the cost of added helpdesk friction), restrict the ability to load or replace credential-provider DLLs and to write to the directories from which they are loaded via application-control or DLL-signing policy (a trade-off in deployment complexity for legitimate provider updates), and monitor Windows event logs and crash dumps for repeated termination of the credential provider or logon-stack processes, which could indicate either a malformed buffer being delivered or a failed exploitation attempt (detection only - it does not prevent the memory disclosure once the buffer is parsed). The vendor patch is the only measure that actually fixes the missing buffer-size and packed-string-offset validation, so treat the controls above as interim risk reduction until 1.4.6.0 is applied everywhere.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Windows credential providers are in-process COM components loaded by the LogonUI/LSASS logon stack that accept serialized credential buffers, unpack them, and translate them into authentication structures. This CVE (CWE-20, improper input validation) is rooted in the Okta Credential Provider's failure to validate a serialized credential buffer before interpreting its contents as a Kerberos logon structure: the buffer length and the offsets of packed strings within it are used without bounds checks, so a crafted buffer drives out-of-bounds reads and writes within the provider process. That class of defect typically manifests as access violations and process crashes, and, in the disclosure case described by the vendor, can copy adjacent process memory into local system logs where it may persist and be readable. The tagging association with buffer-overflow and Microsoft reflects the Windows credential-provider subsystem context rather than any Microsoft product defect. The differentiating factor here is attack surface: the vulnerable parsing path is only reachable by something that can already deliver a credential buffer to the provider locally on the host, and the CVSS vector's PR:H indicates the actor must already hold high privileges, which sharply limits the incremental gain from a successful attack. An independent assessment refines impact to confidentiality high with integrity and availability low (C:H/I:L/A:L) rather than the NVD-style C:H/I:H/A:N, consistent with memory disclosure plus a crash being the demonstrated outcomes.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Local, config/input-dependent flaw requiring privileged control of the credential buffer (AV:L, PR:H); memory disclosure drives C:H, while OOB writes and process termination give limited I and A.
Primary rating from Vendor (okta).
CVSS VectorVendor: okta
Lifecycle Timeline
2DescriptionCVE.org
The Okta Credential Provider for Windows does not validate a serialized credential buffer before interpreting it as a Kerberos logon structure. The buffer size and packed string offsets are not checked. Processing a malformed buffer can cause the credential provider process to terminate unexpectedly or lead to out-of-bounds memory reads and writes, which may result in the disclosure of adjacent process memory into local system logs.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Exploit-DB