EUVD-2026-99935
GHSA-rwcr-3mhr-w8fp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach domain controller over network
-
DeliverySend crafted AD DS request
-
ExploitTrigger out-of-bounds read in parser
-
ExecutionCrash directory service
-
ImpactDeny authentication to domain
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitable without authentication or user interaction (AV:N/AC:L/PR:N/UI:N) against systems running the Active Directory Domain Services role - i.e., Windows domain controllers - that are reachable over the network by the attacker. The key LIMITING factor is exposure: only hosts promoted to domain controllers are affected (not general Windows endpoints), and the attacker must have network path to the AD DS listener. Impact is confined to availability (service crash/DoS); it cannot be leveraged for data disclosure or remote code execution. Affected builds span Windows Server 2012 R2 through Server 2025 and Windows 10/11, each fixed at the specific patch build listed by EUVD. |
| Impact | Signals are mostly consistent and point to a moderate, availability-only threat. The CVSS vector (AV:N/AC:L/PR:N/UI:N) describes a remote, low-complexity, unauthenticated attack, which normally warrants urgency, but the impact is strictly denial of service (C:N/I:N/A:H) - no code execution or data exposure. CISA's SSVC framework reinforces this: Exploitation=none (no observed or public exploitation), Automatable=yes (the unauthenticated network reach makes mass triggering feasible), and Technical Impact=partial, consistent with a crash rather than full compromise. There is no CISA KEV listing and no public POC, so active exploitation is not evidenced. NOTE A CONFLICT: the input Tags ('Buffer Overflow', 'Information Disclosure') imply confidentiality impact, but the CVSS vector explicitly sets C:N and the description describes an out-of-bounds READ used only to deny service - the tags appear mislabeled and should not be read as evidence of data disclosure. EPSS probability was not supplied, so likelihood-of-exploitation cannot be quantified. Net: this is a real operational concern for domain controllers (AD DS outages cascade across authentication) but is not a high-real-risk code-execution flaw; prioritize patching of internet- or untrusted-network-reachable DCs rather than treating it as a critical breach vector. |
| Exploit ScenarioDerived | An attacker with network reach to a domain controller sends a crafted request to the Active Directory Domain Services service, triggering an out-of-bounds read that crashes or hangs the service and denies authentication/directory access to dependent systems. No authentication or user interaction is required (PR:N/UI:N), but the result is service disruption only, not data theft or code execution. No public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Denial of service in Microsoft Active Directory Domain Services (AD DS) allows an unauthenticated remote attacker with a network path to a domain controller to crash the AD DS service by triggering an out-of-bounds read (CWE-125). Exploitation requires the AD DS role to be present, meaning only hosts promoted to domain controllers are realistically at risk; general Windows endpoints are not, even though matching client builds also appear in the vendor's affected-build list. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5) confirms the impact is confined to availability with no confidentiality or integrity loss, CISA SSVC records Exploitation as "none," and no public exploit has been identified at time of analysis; the flaw is rated Automatable: yes, so a reliable trigger could be scripted once reverse-engineered. Vendor patches are available (see advisory https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83647).
RemediationAI
Vendor-released patches are available; apply the Microsoft monthly security update referenced in the MSRC advisory (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83647, EUVD-2026-99935) to reach the fixed builds listed per platform: 6.3.9600.23470 for Windows Server 2012 R2/Server Core, 10.0.14393.9612 for Windows Server 2016/Server Core and Windows 10 1607, 10.0.17763.9376 for Windows Server 2019/Server Core and Windows 10 1809, 10.0.19044.7807 for Windows 10 21H2/22H2, 10.0.20348.5761 for Windows Server 2022, 10.0.26100.33650 for Windows Server 2025/Server Core, 10.0.22631.7652 for Windows 11 23H2, 10.0.26100.9711 for Windows 11 24H2, 10.0.26200.9711 for Windows 11 25H2, 10.0.28000.3231 for Windows 11 26H1, and 10.0.26300.9711 for Windows 11 26H2. Prioritize domain controllers, since those are the only hosts where the AD DS role provides the exposed attack surface, and stage the reboot so that only one DC per domain/site is restarted at a time to preserve quorum-free authentication and replication. Because the rated prerequisites are AV:N/AC:L/PR:N/UI:N and SSVC marks the issue as Automatable, shortening the exposure window matters more than usual. No fully effective workaround exists - AD DS cannot simply be disabled on a domain controller - but as a compensating control during the patch window you can restrict inbound access to domain controller service ports (LDAP 389/636, Kerberos 88, SMB 445, RPC 135 and the dynamic RPC range, and DNS 53 where AD-integrated) using host firewall or network segmentation so that only trusted management subnets and member servers can reach them; the trade-off is that broad restrictions will break domain logon, Group Policy application, and cross-site replication for any client outside the allow-list, so scope rules carefully and monitor for authentication failures. A second, lower-risk option is to temporarily tighten the perimeter around the DC VLAN and alert on anomalous LDAP/SMB connection bursts from untrusted sources, accepting that this is detection and containment rather than prevention. Given SSVC Exploitation: none and no confirmed in-the-wild activity, aggressive break-glass filtering is not warranted; apply the patch on the normal emergency cadence for availability-only, unauthenticated network defects and verify the build number after reboot. Note that CISA's KEV status is not indicated and no public proof-of-concept was identified at time of analysis, so re-check the MSRC advisory for any revision before assuming this remains unexploited.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 18 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Active Directory Domain Services is the directory service role that underpins Windows domain authentication, storing objects and serving them over LDAP/LDAPS, Kerberos, SMB, and RPC-based replication protocols. The root cause class here is CWE-125, an out-of-bounds read, meaning the service processes a malformed or unexpected input in a way that causes it to read past the end of an allocated buffer. In AD DS this class of defect typically surfaces as an access violation and process crash rather than memory disclosure, which is consistent with the assessed vector: AV:N/AC:L/PR:N/UI:N (network-reachable, low complexity, no credentials, no user interaction) with C:N/I:N and A:H. Notably, no CPE strings were supplied in the intelligence feed; affected products are instead enumerated by EUVD as Windows build ranges, spanning Windows Server 2012 R2 (6.3.9600.0), Server 2016/Windows 10 1607 (10.0.14393.0), Server 2019/Windows 10 1809 (10.0.17763.0), Windows 10 21H2/22H2 (10.0.19044.0), Server 2022 (10.0.20348.0), Windows 11 23H2 (10.0.22631.0), Windows 11 24H2/Server 2025 (10.0.26100.0), Windows 11 25H2 (10.0.26200.0), Windows 11 26H1 (10.0.28000.0), and Windows 11 26H2 (10.0.26300.0). Because the AD DS role is only installed when a server is promoted to a domain controller, the practical attack surface is the domain controller population rather than the full set of builds listed, and the presence of client SKUs in that list most plausibly reflects shared binaries or components rather than an exploitable AD DS instance on a workstation. Tags supplied with the record (Buffer Overflow, Information Disclosure) are broader than the assessed impact and should not be read as evidence of data leakage; the independent assessment constrains the effect to a service crash.
Know when Windows gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Unauthenticated remote network trigger against a domain controller (AV:N/AC:L/PR:N/UI:N) with crash-only impact, so C:N/I:N and A:H.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Out-of-bounds read in Active Directory Domain Services allows an unauthorized attacker to deny service over a network.
Executive ViewAI
A high-severity flaw in Microsoft's Active Directory Domain Services (AD DS) could let an unauthenticated attacker cause domain controllers to become unavailable, which may interrupt user logins and access to vital business applications. Although no public exploit exists, leadership should ensure domain controllers are patched promptly because their outage can halt operations across the enterprise.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Twonky Server 8.5.2 uses hard-coded cryptographic keys for encrypting the administrator password. Combined with the cred
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Exploit-DB