EUVD-2026-35699
GHSA-f3mm-ch2c-m27j
Severity by source
AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Integer overflow or wraparound in Windows Kerberos allows an authorized attacker to execute code over an adjacent network.
AnalysisAI
Remote code execution in Microsoft Windows Kerberos implementation allows an authenticated attacker on an adjacent network segment to trigger an integer overflow and execute arbitrary code. The flaw is rated CVSS 7.1 (High) with high attack complexity and requires low-level privileges, and at the time of analysis there is no public exploit identified. Because Kerberos is a core authentication service in Windows domain environments, successful exploitation has direct implications for domain trust and identity security.
Technical ContextAI
The vulnerability lies in Microsoft's Windows Kerberos authentication subsystem, which implements the Kerberos v5 protocol (RFC 4120) for ticket-based authentication across Active Directory environments. The root cause is CWE-190 (Integer Overflow or Wraparound), in which arithmetic operations on attacker-influenced size or length fields wrap past their numeric bounds, producing an undersized buffer allocation or an out-of-bounds index that subsequent code treats as valid. Tagging as both Integer Overflow and Buffer Overflow suggests the wraparound ultimately feeds a memory copy or parsing routine inside Kerberos message handling (likely AS-REQ/TGS-REQ or related PA-DATA structures), corrupting adjacent memory and enabling code execution within the Kerberos service context.
RemediationAI
Apply the Microsoft security update referenced in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47288 to all affected Windows clients and especially to domain controllers, where the Kerberos service is most exposed and most consequential; patch status here is best characterized as patch available per vendor advisory because an exact fixed build was not included in the supplied data. Until patches are deployed, compensating controls should focus on shrinking the adjacent-network attack surface: segment domain controllers onto management VLANs that exclude general user and guest traffic, enforce 802.1X or NAC on segments that host DCs to keep unauthorized devices off the same broadcast domain, and disable or restrict legacy Kerberos transports if not required (note that tightening UDP/88 or TCP/88 reachability will break authentication for any client that legitimately sits on a now-blocked segment, so validate site topology first). Monitor Kerberos service crashes and unexpected lsass.exe restarts as a detection signal for exploitation attempts.
More in Windows Server 2012
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Remote code execution in Microsoft Office 2007-2016 and Windows Vista through 10 allows attackers to execute arbitrary c
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
The Win32k kernel-mode driver in Windows Vista through Windows Server 2016 allows local privilege escalation, exploited
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Active Directory Domain Services Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.5), this vulnerabilit
Same weakness CWE-190 – Integer Overflow or Wraparound
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today