EUVD-2026-43906
GHSA-jw44-x36j-888r
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remote, unauthenticated, low-complexity network request crashes the service (AV:N/AC:L/PR:N/UI:N); impact is availability-only DoS, so C:N/I:N/A:H with unchanged scope.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Stack-based buffer overflow in Active Directory Federation Services allows an unauthorized attacker to deny service over a network.
AnalysisAI
Denial of service in Microsoft Active Directory Federation Services (AD FS) allows a remote, unauthenticated attacker to crash or render the federation service unavailable by triggering a stack-based buffer overflow over the network. The flaw affects the AD FS role across Windows Server 2012 through 2025 (including Server Core installations) and carries a CVSS 7.5 rating driven entirely by availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but a vendor patch is available.
Technical ContextAI
AD FS is Microsoft's on-premises identity federation and single sign-on (SSO) service that issues security tokens (SAML/WS-Federation/OAuth) to broker authentication between organizations and relying-party applications. The vulnerability is classified as CWE-121 (Stack-based Buffer Overflow), meaning a fixed-size buffer on the call stack is overrun when the service processes attacker-supplied network input, corrupting stack memory such as the return address or adjacent local variables. Because AD FS endpoints are typically exposed to internal networks and, via the Web Application Proxy, sometimes to the internet to support federated logins, the parsing path that mishandles the input is reachable remotely. The affected CPE set spans the Windows Server family (2012, 2012 R2, 2016, 2019) with tags additionally naming Server 2022 and 2025, indicating the defective code resides in the AD FS role component shared across these OS versions rather than in a single OS build.
RemediationAI
Patch available per vendor advisory: apply the Microsoft security update for CVE-2026-50355 detailed at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50355, selecting the KB package matching each AD FS server's Windows Server version (2012 through 2025, including Server Core). Because the input data does not include an exact fixed build number, obtain the specific version from the MSRC update guide rather than assuming a value. Until patching is complete, reduce exposure by ensuring AD FS endpoints are not directly internet-facing - publish them through a Web Application Proxy that can terminate and filter federation traffic - and restrict network reachability of the AD FS service ports to only the proxy and trusted relying parties; the trade-off is that overly aggressive filtering can block legitimate federated logins, so validate rules against your relying-party inventory. Monitor AD FS service health and the Windows Event Log for unexpected service restarts as an early indicator of exploitation attempts.
More in Windows 10 Version 1607
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to run arbitr
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem
Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating
Remote code execution in Microsoft Windows Remote Desktop (RDP) allows an unauthorized network attacker to run arbitrary
Same weakness CWE-121 – Stack-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today