EUVD-2026-43761
GHSA-2q6g-jrff-pxhq
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attacker requires low-privilege domain authentication to reach AD DS over network; crash impact is availability-only with no confidentiality or integrity consequence.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Null pointer dereference in Active Directory Domain Services allows an authorized attacker to deny service over a network.
AnalysisAI
Null pointer dereference in Windows Active Directory Domain Services (AD DS) enables a low-privileged authenticated attacker to crash the service remotely, causing denial of service across the affected domain. The flaw spans a wide range of Windows client and server releases, from Windows 10 version 1607 through Windows 11 version 26H1 and Windows Server 2012 through 2025. No public exploit code has been identified and this vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog at time of analysis, though the network-accessible attack surface and low privilege requirement lower the bar for abuse in environments with broad domain user access.
Technical ContextAI
CWE-476 (Null Pointer Dereference) describes a class of bug where code dereferences a pointer expected to be valid but which is NULL, causing an unhandled exception and typically a process crash. In Active Directory Domain Services - the Windows implementation of LDAP-based directory services used for authentication, authorization, and policy enforcement across Windows domains - a crafted request can trigger this condition in the AD DS service process. The CPE data identifies affected products spanning cpe:2.3:a:microsoft:windows_10_version_1607 through cpe:2.3:a:microsoft:windows_server_2012_r2 and additional server releases tagged in the advisory, indicating the vulnerable code path exists across both client OS builds (where AD DS roles may be present) and all major Windows Server generations. The network-accessible AD DS interface most commonly manifests over LDAP (TCP 389/636) or Kerberos-related protocols, meaning any authenticated network client can potentially reach the vulnerable component.
RemediationAI
Microsoft has released a patch for this vulnerability; apply the relevant cumulative update for each affected Windows version as detailed in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57976. An exact fixed build version was not specified in the available data - consult the advisory directly to identify the minimum patched cumulative update for each OS version in use. Patch available per vendor advisory. Until patching is complete, organizations can reduce exposure by restricting which authenticated accounts can reach domain controller LDAP ports (TCP 389/636, TCP 3268/3269) at the network layer, noting that overly restrictive firewall rules on domain controllers may disrupt legitimate Kerberos and LDAP traffic and should be tested carefully before deployment. Segregating high-value domain controllers behind network access controls to limit which user segments can initiate sessions against them reduces the pool of potential attackers without requiring a patch rollout.
More in Windows Server 2012
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Remote code execution in Microsoft Office 2007-2016 and Windows Vista through 10 allows attackers to execute arbitrary c
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
The Win32k kernel-mode driver in Windows Vista through Windows Server 2016 allows local privilege escalation, exploited
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Active Directory Domain Services Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.5), this vulnerabilit
Same weakness CWE-476 – NULL Pointer Dereference
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today