Windows KDC CVE-2026-84001

The target system must be a Windows Domain Controller actively running the KDC role - this role is present on all DCs by default and is not configurable to disable without demoting the DC. The attacker must have network-level access to the Domain Controller on TCP/UDP port 88 (the Kerberos port); no authentication is required per CVSS PR:N. No non-default configuration is needed to trigger the vulnerability. Exploitation is bounded by network reach: environments that block port 88 access to Domain Controllers from untrusted network segments (e.g., via perimeter firewalls, micro-segmentation, or zero-trust policies) substantially reduce exposure. Windows 10 and 11 client builds are listed as affected in the EUVD version data, but client systems do not run the KDC role in standard deployments, so client-side exploitation from this specific vulnerability appears limited to the server-side KDC code path.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5) accurately captures the attack profile: the KDC is network-reachable without authentication, exploitation requires no special conditions, and impact is confined to availability. The S:U (scope unchanged) rating formally limits the blast radius to the KDC service itself, but in practice the organizational impact is domain-wide - when the KDC is unavailable, all Kerberos-dependent authentication fails across every AD-joined system, service account, and application in the domain. This represents a meaningful real-world amplification beyond what the 7.5 score communicates in isolation. No KEV listing is present in the input, no EPSS score was provided, and no public POC has been identified, placing exploitation status as unconfirmed. Priority should nonetheless be elevated for Domain Controllers, particularly in environments without redundant KDC infrastructure. The 'Buffer Overflow' and 'Information Disclosure' input tags are both mislabeled: CWE-125 is an out-of-bounds read (not a write/overflow), and the CVSS C:N metric confirms no confidentiality impact.

An unauthenticated attacker with network access to a Domain Controller sends a specially crafted Kerberos packet to TCP/UDP port 88, triggering an out-of-bounds read in the KDC's packet-parsing routine that causes the service to crash. If the attack is sustained or replicated against multiple Domain Controllers simultaneously, Kerberos authentication fails domain-wide, locking out all users, service accounts, and systems relying on AD for authentication. No public exploit code has been identified at time of analysis.